#Ransomware #STOP

神龟Turmi

看起来是多阶段的，这个样本是第一阶段的，且下载目标还活着
勒索信：

1. ATTENTION!
   
2. 
   
3. Don't worry, you can return all your files!
   
4. All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
   
5. The only method of recovering files is to purchase decrypt tool and unique key for you.
   
6. This software will decrypt all your encrypted files.
   
7. What guarantees you have?
   
8. You can send one of your encrypted file from your PC and we decrypt it for free.
   
9. But we can decrypt only 1 file for free. File must not contain valuable information.
   
10. You can get and look video overview decrypt tool:
    
11. https://we.tl/t-xZJtZ8PDb2
    
12. Price of private key and decrypt software is $980.
    
13. Discount 50% available if you contact us first 72 hours, that's price for you is $490.
    
14. Please note that you'll never restore your data without payment.
    
15. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
    
16. 
    
17. 
    
18. To get this software you need write on our e-mail:
    
19. support@freshmail.top
    
20. 
    
21. Reserve e-mail address to contact us:
    
22. datarestorehelp@airmail.cc
    
23. 
    
24. Your personal ID:
    
25. 0758JOsie

复制代码

样本（国内）：https://share.weiyun.com/GPaBJUye
样本（海外）：https://www.icloud.com/iclouddri ... b5b1d816b8a48f9fd8f

VT：https://www.virustotal.com/gui/f ... 04c8c75cc/detection
处扫：


S1 KILL（Static AI - Suspicious PUA）


PS：这S1什么时候得了Sophos的病。。。啥都是PUA

UNknownOoo

火绒
扫描：沙盒行为 1X

双击：主防 1X

dght432

类型:木马-HEUR/QVM10.2.2991.Malware.Gen
描述:木马是一种伪装成正常文件的恶意软件，会盗取您的帐号、密码等隐私资料。
扫描引擎:云特征引擎
文件路径:D:\360安全浏览器下载\sample-e716f8fb75e76b5b1d816b8a48f9fd8f\9ac5fb2dfc6bb606770d3062731fd4d9a0137b04970c6c4bebf496204c8c75cc
文件大小:709K (726,016 字节)
文件指纹（MD5）:e716f8fb75e76b5b1d816b8a48f9fd8f
处理建议:隔离文件

wwwab

火绒kill

xjwtzq

360sd kill

断簪

biue

喀反

WD:Trojan:Win32/Wacatac.H!ml

wwwab

kuroandsan

BD

Gen:Suspicious.Cloud.4.Sq0@aOP08oe