Severity
High
Analysis Summary
Vovabol Ransomware is a fake or pretend ransomware which is actually an extortionist. The threat actor demands $50 or its rubles equivalent. The malware is Russian themed and targets Russian users. Contents of the ransom note: Data encryption/algorithm NEMEZIDA/ DO NOT DELETE ANYTHING FROM THE DESKTOP To decrypt, pay $50 or the equivalent in rubles to the payment system: QIWI (https://qiwi ru) to wallet +79670298024 or +79154862476 In the comments to the payment, indicate: 1. Your key number 1 – see the file INSTRUCTIONS.txt on the desktop 2. Your email (key number 2 will be sent to it for decryption) FOR DECRYPTION * On your desktop, run DECRYPT * Carefully enter the received key number 2 and press START * Decryption will take some time, do not close the decryption program, be sure to wait for the successful processing message * During processing, do not use the computer and do not turn off. If processing did not pass completely (for example, the computer turned off), write a letter to mnovazeml@online.ua / vovabol@inbox.lv
Impact
- File Encryption
Indicators of Compromise
Filename
- 10101010[.]exe
MD5
- 2b99e5c85cd8b0e6decf30d6daee094e
SHA-256
- e4defd8a187a513212cb19c9f2a800505395e66d9cd9eb3a96c291060224e7dd
SHA-1
- c3e7652e16a2e03d96b0274b5520d19b96196a03
Remediation
- Block all threat indicators at your respective controls
- Search for IOCs in your environment.