alphv Ransomware DM7X4LO

[Iwan Herdian 0]

Hi,

 

This morning I got infected by DM7X4LO. So many of my files have extension DM7X4LO

 

I got some messages like below:

 

Data on Your network was exfiltrated and encrypted.

Modifying encrypted files will result in permanent data loss!

Get in touch with us ASAP to get an offer:
1. Download and install Tor Browser from https://www.torproject.org/
2. Access User Panel at 
   

THIS IS YOUR PRIVATE USER PANEL ADDRESS, DO NOT SHARE IT WITH ANYONE!

See also:
  Visit our Blog: http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion
  Social Media: https://twitter.com/search?q=%23alphv
  
Ÿ¤G"ø´%g%VÅÄg¼3ºþ"‰¤6-TÇŠÌ=æ c

 

kindly advise,

 

How to resolve this

 

Regards,

Ivan

Изменено 27 апреля, 2023 пользователем Iwan Herdian

[Sandor 1 285]

Hello,

Please read and do some analysis and attach the requested files - Порядок оформления запроса о помощи

You can use Google translate surely.

Briefly, we need a couple of encrypted documents and ransome note itself (not quoted).

[Iwan Herdian 0]

Hi Sandor,

 

Thanks for your reply.

 

I attach the result from farbar and two encrypted file that infected

 

Regards,

Iwan

FARBAR ARCHIVE.zip

[Sandor 1 285]

Thank you for the logs.

I see several text files with random name:

Цитата

 

C:\Users\SONIA1437\8Rx3Ia6FGzncWG.txt

C:\Users\ksnproxy\v2iFUiRcIM7u4.txt

...

C:\ProgramData\fGveaffwPUsu8Cjg9L6RBlcfOivVU.txt

C:\MvU0Mr68S99BKWd0FCsheR.txt

 

Is that the same ransom note?

If so, please attach it also to your next message and we'll try to identify the ransom itself.

 

You have Kaspersky Endpoint Security for Windows installed, so you can ask the tech support directly via your Company Account.

[Iwan Herdian 0]

Hi Sandor,

 

I attach the file

 

Thanks for your help

 

Regards,

Iwan

MvU0Mr68S99BKWd0FCsheR.zip

[Sandor 1 285]

• Turn off antivirus until reboot.
• Highlight following code:

  Start::
  CloseProcesses:
  SystemRestore: On
  CreateRestorePoint:
  GroupPolicy: Restriction ? <==== ATTENTION
  Policies: C:\Users\020001437\NTUSER.pol: Restriction <==== ATTENTION
  Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
  Task: {7FA88F2E-253D-461D-B328-2C9797DE17DE} - System32\Tasks\google_update => cmd.exe /c \\sonia.net\netlogon\xxx.exe 0hzlY -JmmQ0 -blk -fFAjpN24WLXkg7owTMas1O_fJPk -BR -rvi12 -u_W5fs -KP6qIH <==== ATTENTION
  2023-04-27 08:30 - 2023-04-27 08:30 - 000000952 _____ C:\Users\SONIA1437\8Rx3Ia6FGzncWG.txt
  2023-04-27 08:30 - 2023-04-27 08:30 - 000000952 _____ C:\Users\ksnproxy\v2iFUiRcIM7u4.txt
  2023-04-27 08:30 - 2023-04-27 08:30 - 000000952 _____ C:\Users\DefaultAppPool\txXVP5yNoNo5gX4nAJgQ.txt
  2023-04-27 08:30 - 2023-04-27 08:30 - 000000952 _____ C:\Users\Classic .NET AppPool\7I6th59OwDDYcfvTKXl43qtYI.txt
  2023-04-27 08:30 - 2023-04-27 08:30 - 000000952 _____ C:\Users\ASP.NET v4.0\GE2Svjiim.txt
  2023-04-27 08:30 - 2023-04-27 08:30 - 000000952 _____ C:\Users\ASP.NET v4.0 Classic\1e3UZalv5iH3745zT4n3Ce.txt
  2023-04-27 08:30 - 2023-04-27 08:30 - 000000952 _____ C:\Users\020001437\4Ej4SK8ezF8.txt
  2023-04-27 08:15 - 2023-04-27 08:15 - 000000952 _____ C:\ProgramData\fGveaffwPUsu8Cjg9L6RBlcfOivVU.txt
  2023-04-27 08:12 - 2023-04-27 08:12 - 000000000 _____ C:\Windows\efDZDnJTY11KMnLhGYiHk.exe
  2023-04-27 08:11 - 2023-04-27 08:11 - 000000952 _____ C:\MvU0Mr68S99BKWd0FCsheR.txt
  2023-04-27 08:09 - 2023-04-27 08:09 - 000003740 _____ C:\Windows\system32\Tasks\google_update
  Zip:C:\Windows\efDZDnJTY11KMnLhGYiHk.exe
  FCheck: C:\Windows\efDZDnJTY11KMnLhGYiHk.exe [2023-04-27] <==== ATTENTION (zero byte File/Folder)
  FirewallRules: [{53F27307-030B-4EE7-9BB5-549E71EEB61E}] => (Allow) LPort=90
  FirewallRules: [{50CD2627-5609-4786-B4FC-48204C2AFDDC}] => (Allow) LPort=90
  FirewallRules: [{3C66CF85-EAED-4D72-B9CC-2D8D13D575C1}] => (Allow) LPort=1688
  FirewallRules: [{C9C5EDB3-6F8E-4C61-A73F-0AE383E2F0C5}] => (Allow) LPort=8501
  FirewallRules: [{3D530FAE-2FFD-4941-8B82-92395067F82F}] => (Allow) LPort=8501
  Zip: c:\FRST\Quarantine\
  Reboot:
  End::

   

• Copy highlighted (right click - copy).
• Run file C:\Users\SONIA1437\Downloads\FRST64.exe as administrator.
• Press Fix button and wait. Program will create (Fixlog.txt). Attach it to your next message.

PC will reboot. Find at your Desktop file named Date_Time.zip and send it to this address: quarantine <at> safezone.cc (replase <at> to @).

 

Unfortunately there is no known method to decrypt this kind of ransom.

Nevertheless it is good idea to tell about it to tech support as I mentioned before.

 

Later on we'll give you recomendations to protect your system.

Изменено 28 апреля, 2023 пользователем Sandor