The Ransomware Blog

Search Ransomware Blog

Contact Us

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

At moment we don't have any communication channel. Will update soon!

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Comments

LLTP Locker Ransomware - IOC - File Details

1) Ransomware Name - LLTP Locker

2) Encrypted Extensions -
.ENCRYPTED_BY_LLTP
.ENCRYPTED_BY_LLTPp

3) Ransom Note File - LEAME.txt

4) Encrypted Algorithm - AES-256 + RSA

5) Decryptor Link - NA

6) Screenshot -

7) Indicaators of Compromise -
xxxx://i.imgur.com/VdREVyH.jpg - скринлок на обои;
xxxx://moniestealer.co.nf/nran/gen.php - C&C-сервер;
Email: LLTP@mail2tor.com

8) File Details -
MD5 4eaac55ddd279d402d0aba8707b9ca5b
SHA1 353420879d240926ee3be94486358e1495381b53
SHA256 46f8dc86d571a6bda00faade21b719ec82c5a1dda3b0fc54bb053a5004557e2d
ssdeep12288: AdgtTWupXNT35AcFqTC9mUoE + Yfz3OlZUW + 7xsvceR0KtjYxQFmLv: thZpXJ3SGqTC9l5Br3qZlCxarjpFmLv
authentihash d49fb088b5e847cedc9b33b880862ab7760be05620363104035a795327ff6a26
imphash f34d5f2d4577ed6d9ceec516c1f5a744
The size of the file is 939.0 KB (961536 bytes)
Win32 EXE file type
DescriptionPE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono / .Net assembly

MD5 ed3dad6c60222d6a90716ea77769511d
SHA1 25e6d131dfcf5cca9f5330a7a65faf…

LanRan Ranosmware - IOC - File Details

1) Ransomware Name - LanRan

2) Encrypted Extensions - NA

3) Ransom Note File -
@__help__@
lan.exe
<random>.exe

4) Encrypted Algorithm - AES / RSA, RSA-2048

5) Decryptor Link - NA

6) Screenshot -

7) Indicators of Compromise - Email: lanran-decrypter@list.ru

8) File Details -
MD5 05c95cefcc2292424ffc1aff84215a4e
SHA1 83eeb67e6deaa063979aa5bbde7e9d9eeabab577
SHA256 875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0
ssdeep6144: 8fkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk4: 8fkkkkkkkkkkkkkkkkkkkkkkkkkkkkkL
authentihash 3b0ee0c5785413994d3c42f0f5c3c7d8d60591c80467afa532cb0bcebb07ab66
imphash f34d5f2d4577ed6d9ceec516c1f5a744
The size of the file is 197.5 KB (202240 bytes)
Win32 EXE file type
DescriptionPE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono / .Net assembly

MD5 3273438de838bc9b630ed2f032a6ee0b
SHA1 e5cd6355f867d4ab24f14905525ac0cfc0b5dc49
SHA256 0e1577001fd5c5a2fe5ad9f8f88fec37caf1389dc2fd4e25c56bb7e5f426cb41
ssdeep1536: B81b189BMa9…

Locked-In Ransomware - IOC - File Details

1) Ransomware Name - Locked-In

2) Encrypted Extensions - .novalid

3) Ransom note File -
RESTORE_CORUPTED_FILES.HTML
RESTORE_NOVALID_FILES.HTML

4) Encrypted Algorithm - AES-256

5) Decryptor Link - https://www.google.com/url?
q=https://www.bleepingcomputer.com/forums/t/634754/locked-in-ransomware-help-support-restore-corupted-fileshtml/&sa=D&ust=1505219068689000&usg=AFQjCNF9ioLcjI8uj-Oh5swSsBA9DBqXMw

6) Screenshot -

7) indicators of Compromise - NA

8) File Details -
MD5 b6ffac29f16e859b7aa8ab7f62b0bcef
SHA1 2eb0644345f4fbde656f316c7d9ce6866ec4335e
SHA256 8cc8125ce0cace7e1f090015a7a2e55aa0bbd06318a3f29c0a11cb6c85ad2264
ssdeep768: L / 1L41c / gaxme9hpfILteybyD1D9Hnfl9AtSy: L9LQOALMybyDJ9N9Aoy
authentihash e4ca172031e3b85a97b9ca031b97ec94c9d32d9e7cdb33a6349462c01130ead4
imphash f34d5f2d4577ed6d9ceec516c1f5a744
The size of the file is 38.0 KB (38912 bytes)
Win32 EXE file type
DescriptionPE32 executable for MS Windows (GUI) Intel 80386 Mono / .Net assembly

Powered by Blogger

Contact Us

Comments

Post a Comment