Malware Anaylsis by SoundDrout

Malware Anaylsis

bluxtrv — 2021-11-21 13:24:22 UTC

Hi and welcome to malware anaylsis. We are anaylzing malware for hobbies. Major Sponsers: @Hyperistic Blast, @Creepster, @Sonic.exe
Visit: http://pccreepermalware.tilda.ws

1. Scorpion Virus

bluxtrv — 2021-11-21 13:30:58 UTC

Name: Scorpion virus
Creator: Arab TEC
Basic Facts: Scorpion is a dangerous Ransomware that affects Microsoft Windows systems. This ransomware was sent to the FMV series of the popular malware YouTuber Siam Alam.

Payload: After the virus is executed it cuts to a screen saying: "Welcome to Scorpion Virus" . The screen then says: "Enter the code to unlock virus" The user will then have 3 tries to enter the code correctly. If the user doesn't enter the code correctly after three tries the virus locks the computer on the virus screen.

Version 2: After the virus is executed it will restart the computer. After the user restarts, the computer starts normally. But, when the user attempts to log on, the screen will be locked and there will be a message saying:

"Welcome to Scorpion Virus"

Then the user will need to wait for a loading red bar, after that, there would be a screen with a scorpion saying:

"Scorpion is here"

Then a message saying:

'Oops! Your computer has been locked! and all your files have been encrypted! you cannot do anything, just cry!'.

Then the user will have 30 seconds to unlock the computer with a VIP Code to unlock.

If the user tries to open task manager via ctr+alt+del they will get a message saying:

"Don't try that again."

Version 3: Version 3 completely changed Scorpion virus instead of resetting computer upon activation the screen cuts to a cinematic screen. First it cuts to a broken/updated T.V. screen then it cuts to the scorpion logo going down then it finally stops and is greeted with:

Welcome to Scorpion Virus

A few seconds later under that it says Your computer is died

If the user restarts the computer it cuts to a black screen despite the fact that there is nothing wrong with the registry. There are theories that it wipes out explorer.exe entirely.

Version 3.1: Fixed grammar issues, Your computer is died -> Your computer is dead

2. 000.exe

merch — 2021-12-09 00:18:45 UTC

Name: 000 executable
Creator: Flytech Videos
Basic Facts:
000.exe is a virus that infects Microsoft Windows running Windows NT based kernels.

The website which was used to download the first version showed a blue hyperlink with green background.

The YouTuber FlyTech Videos created the first version of this virus that showed a website that automatically tried to download 000.exe, the website contains a hyperlink with a green background. After development, he made a video about it on his Windows 8 Virtual Machine and explaining its payloads.

In mid-2016, FlyTech Videos released a video on its development stages and given a download link to download the virus. Shortly after, a YouTube user, Gigabyte_Forever, demonstrated on how to disinfect a Windows operating system that was affected by this type of virus.

Payload:
When executed, a User Account Control dialogue box appears (only in Windows Vista, onward) warning the user if they want to execute the program.

This virus uses a few payloads from other malware pieces such as Maldal. When fully executed, explorer.exe gets terminated, the virus will also attempt to remove the contents inside the WindowsApps folder which contains installed Windows Universal Apps (only in Windows 8 and 10). The video clip also loops in the background. The video showcased a picture of a scary road changing color from orange, to green, to black and white, and to intense black and white.

During video playback, the virus disables Task Manager, change the user's Windows account name to "UR NEXT", change the default notepad icon to a custom .ico file, and reboot the user's computer once it is finished with its first payload.

The second payload occurs when the computer is restarted. The user will be greeted with many changes made on the user's computer which includes, the desktop wallpaper is changed, and shows an accent color black, the user's desktop is filled with "UR NEXT" Notepad files on the desktop (as it used Maldal's payloads). The default Notepad icon is changed to a red square with "UR" and "NEXT" with the former stacked on top of the latter. Opening one "UR NEXT" file, the user will see seemingly infinite lines of the words "UR NEXT".

The dialog box shown in Windows 8.1 during its second payload.

Once Windows is loaded, there will be a dialogue box that contains the message "run away", followed by a "run away" button. However, each second a new dialogue box with the same message appears nonstop. Clicking on the run away button closes the message.

If a user opens the "OPENME" (repeated name) WordPad file, the user will see the text from the file:

YOU ARE THE NEXT,
I CAN SEE YOU


NOW ITS TOO LATE
I GOT YOU.......

YOU HAVE BEEN
WARNED

DONT LOOK BEHIND YOU

The name of the WordPad file is named "OPENME" (repeated name) to persuade the user to open it. Also, the file's message is that "a serial killer is behind you to stab you, that is why don't look behind you." There have been no reports of serial killers linked to this virus; this is likely just intended to frighten those with infected devices.

Removal:
Windows 10 and Windows 8

While the never-ending pop-ups happen, right-click on the Start button and click on "Command Prompt (Admin)". Type in the following command: taskkill /f /im conhost.exe. The command helps to stop the never-ending pop-ups, but not close them. After that, the Command Prompt should close. After it closed, reopen it. And then type in the following command: taskkill /f /im runaway.exe. The command helps to close all the pop-ups. Do not close the command prompt window.

From the command prompt window, type in the command: cd C:/users/[the user's account name]/Desktop (the user's account name can be found on C:/Users and the name of the folder with a padlock is the user's account name). And then type in: del *.* /s /q, but before typing in that command, make backups as the command deletes everything on the user's desktop. One way of making backups is creating a new folder on Local Disk (C: or D:) and naming the folder My Important Desktop Files. Select the users most important files on the user's desktop, the user has to press Ctrl+X on the user's keyboard, navigate to the user's My Important Desktop Files folder on Local Disk (C: or D:) and finally press Ctrl+V on the user keyboard. The transfer may take several minutes. Once the transfer is complete the user can use the command.

After the "UR NEXT" files are deleted in the user's desktop, navigate to the user's My Important Desktop Files folder on Local Disk (C:/D:), press Ctrl+A on the user's keyboard and then Ctrl+X, go to the user's desktop, and then finally press Ctrl+V. Wait for the transfer to complete.

And then press Win+R to activate the Run box. Type in %temp% in the Run box and press Enter.

From the Temp folder, the user should see the window containing some files. From there, the user can see that it has written some files including the video used in the virus.

The files are:

5476d0c4a7a347909c4b8a13078d4390.db
5476d0c4a7a347909c4b8a13078d4390.db....
icon.ico
one.rtf
miw.exe
sa.9NBLGGH1ZRPV_0_0010.Public.Install...
text.txt
tmpC7C1.tmp
v.mp4
wct46AB.tmp
wct81BC.tmp
wct554A.tmp
windl.bat
Windows10UpgradeVersion.txt
wmsetup.log

NOTES:

"icon.ico" is the "UR NEXT" icon.
"v.mp4" is the video of the virus.
"windl.bat" is the virus's code.

Now if the user wants to, the user can delete the files in the folder except for the subfolders. The Temp folder is where all of the temporary files are located.

Now delete the 7DDA.tmp folder.

And then create a text document. And then copy and paste the source code:

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=-

And then save the document as a .reg file. Open the .reg file.

Right-click on the user's desktop and click on Personalize. At the Background section, click on Solid color and choose Picture. Choose the first picture, which is the very left picture. And then refresh the user's desktop. Restart the user's computer.

Open Task Manager and navigate to Startup. Find miw.exe from the process list and click on Open file location. And then the user will see two files from the pop-up window, miw.exe and desktop.ini. Delete the files.

Search "user" and open User Accounts. From here the user can change the user's username back. the user may also change the user username. Click on Change your account name. And in the New account name box type in the user's original username or the user's new username. and then click Change Name.

After all of it, restart for the changes to take effect.

To correct the "UR NEXT" icons on all TXT files, download FilesTypesMan and find TXT and then replace them in the Default Icon field of the TXT format and replace its contents with "C:\Windows\System32\imageres.dll,7".

4. SparkCript

creepypastavirus — 2021-12-09 01:04:18 UTC

Name: SparkCript or SparkCrypt
Creator: LordCracker
Basic Facts: SpartCript or SpartCrypt is a ransomware that runs on Microsoft Windows. It was discovered by S!Ri. It is part of the HiddenTear family. It uses code of Jigsaw, Crypto, CyberResearcher, Executioner, Resurrection, and Ryzerio. It is aimed at English-speaking users. It uses a ransom note similar to Phobos.

Payload:
Transmission

SpartCript is distributed by hacking through an unprotected RDP configuration, using email spam and malicious attachments, deceptive downloads, botnets, exploits, malicious ads, web injects, fake updates, repackaged and infected installers.

Infection

SpartCrypt encrypts victim's data and renames all encrypted files by adding its name, email address of its developers, victim's ID and ".Encrypted" extension to their filenames. For example, it renames "1.jpg" to "1.jpg.SpartCrypt[LordCracker@protonmail.com]-[ID-1E857D00].Encrypted", and so on. Also, it creates a text (.txt) file titled "How_To_Restore_Your_Files.txt" and displays a pop-up window, both of them contain information on how to contact SpartCrypt and other details.

Cyber criminals who designed SpartCrypt can be contacted via furhlordcracker@protonmail.com and phabos@cock.li email addresses. Victims have to send them the appointed unique ID and can attach up to 5 files. These cyber criminals offer to decrypt them for free.

After that they will name the price of a decryption, it is stated that it depends on how fast they will be contacted. Either way, they promise to send decryption tool after a payment which must be using Bitcoin cryptocurrency.

Text presented in SpartCrypt ransomware's pop-up window:

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you 
want to restore them, write us to the e-mail LordCracker@protonmail.com - 
Phabos@cock.li
Write this ID in the title of your message -
You have to pay for decryption in Bitcoins. The price depends on how fast you write 
to us. After payment we will send you the tool that will decrypt all your files.

Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files 
must be less than 4Mb (non archived), and files should not contain valuable 
information. (databases,backups, large excel sheets, etc.)

How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy 
bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/

Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent 
data loss.
Decryption of your files with the help of third parties may cause increased price (they 
add their fee to our) or you can become a victim of a scam.

Text in How_To_Restore_Your_Files.txt:

SpartCript


[+] All Your Files Have Been Encrypted [+]

[-] Do You Really Want To Restore Your Files?
[-] Write Us To The E-Mail : LordCracker@protonmail.com - Phabos@cock.li
[-] Write Your Unique-ID In The Title Of Your Message.
[+] Unique-ID : -
[-] You Have To Pay For Decryption In Bitcoins.
[-] The Price Depends On How Fast You Write To Us.
[-] After Payment We Will Send You The Decryption Tool
That Will Decrypt All Your Files.

----------

[+] Free Decryption As Guarantee [+]

[+] Before Paying You Can Send Us Up To 5 Files For
Free Decryption, The Total Size Of Files Must Bee Less
Than 10MB, (Non Archived) And Files Should Not Contain
Valuable Information (Databases, Backups, Large Excel
-Sheets, Etc).

----------

[-] The Easiest Way To Buy Bitcoins Is LocalBitcoins
Site : hxxps://localbitcions.com/buy_bitcoins
You Have To Register, Click 'Buy Bitcoins', And Select
The Seller By Payment Method And Price.
[-] Also You Can Find Other Places To Buy Bitcoins And
Beginners Guide Here:
hxxp://coindesk.com/information/how-can-i-buy-bitcoins

----------

[-] Do Not Rename Encrypted Files.
[-] Do Not Try To Decrypt Your Data Using Third Party
-Software, It May Cause Permanent Data Loss.
[-] Decryption Of Your Files With The Help Of Third
Parties May Cause Increased Price (They Add Their Fee
To Our) Or You Can Become A Victim Of A Scam.