{
	"id": "fc14fa9d-37da-4e5f-a667-c5643b2f577d",
	"created_at": "2026-04-06T00:21:42.260239Z",
	"updated_at": "2026-04-10T03:21:53.34078Z",
	"deleted_at": null,
	"sha1_hash": "6e8b4bee0b5ab86b88fad4e5eeaa3846671f2e27",
	"title": "MAR-10330097-1.v1: DearCry Ransomware | CISA",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 129045,
	"plain_text": "MAR-10330097-1.v1: DearCry Ransomware | CISA\r\nPublished: 2021-04-12 · Archived: 2026-04-05 13:03:40 UTC\r\nbody#cma-body { font-family: Franklin Gothic Medium, Franklin Gothic, ITC Franklin Gothic, Arial, sans-serif; font-size:\r\n15px; } table#cma-table { width: 900px; margin: 2px; table-layout: fixed; border-collapse: collapse; } div#cma-exercise {\r\nwidth: 900px; height: 30px; text-align: center; line-height: 30px; font-weight: bold; font-size: 18px; } div.cma-header { text-align: center; margin-bottom: 40px; } div.cma-footer { text-align: center; margin-top: 20px; } h2.cma-tlp { background-color: #000; color: #ffffff; width: 180px; height: 30px; text-align: center; line-height: 30px; font-weight: bold; font-size:\r\n18px; float: right; } span.cma-fouo { line-height: 30px; font-weight: bold; font-size: 16px; } h3.cma-section-title { font-size:\r\n18px; font-weight: bold; padding: 0 10px; margin-top: 10px; } h4.cma-object-title { font-size: 16px; font-weight: bold;\r\nmargin-left: 20px; } h5.cma-data-title { padding: 3px 0 3px 10px; margin: 10px 0 0 20px; background-color: #e7eef4; font-size: 15px; } p.cma-text { margin: 5px 0 0 25px !important; word-wrap: break-word !important; } div.cma-section { border-bottom: 5px solid #aaa; margin: 5px 0; padding-bottom: 10px; } div.cma-avoid-page-break { page-break-inside: avoid; }\r\ndiv#cma-summary { page-break-after: always; } div#cma-faq { page-break-after: always; } table.cma-content { border-collapse: collapse; margin-left: 20px; } table.cma-hashes { table-layout: fixed; width: 880px; } table.cma-hashes td{ width:\r\n780px; word-wrap: break-word; } .cma-left th { text-align: right; vertical-align: top; padding: 3px 8px 3px 20px;\r\nbackground-color: #f0f0f0; border-right: 1px solid #aaa; } .cma-left td { padding-left: 8px; } .cma-color-title th, .cma-color-list th, .cma-color-title-only th { text-align: left; padding: 3px 0 3px 20px; background-color: #f0f0f0; } .cma-color-title td,\r\n.cma-color-list td, .cma-color-title-only td { padding: 3px 20px; } .cma-color-title tr:nth-child(odd) { background-color:\r\n#f0f0f0; } .cma-color-list tr:nth-child(even) { background-color: #f0f0f0; } td.cma-relationship { max-width: 310px; word-wrap: break-word; } ul.cma-ul { margin: 5px 0 10px 0; } ul.cma-ul li { line-height: 20px; margin-bottom: 5px; word-wrap:\r\nbreak-word; } #cma-survey { font-weight: bold; font-style: italic; } div.cma-banner-container { position: relative; text-align:\r\ncenter; color: white; } img.cma-banner { max-width: 900px; height: auto; } img.cma-nccic-logo { max-height: 60px; width:\r\nauto; float: left; margin-top: -15px; } div.cma-report-name { position: absolute; bottom: 32px; left: 12px; font-size: 20px; }\r\ndiv.cma-report-number { position: absolute; bottom: 70px; right: 100px; font-size: 18px; } div.cma-report-date { position:\r\nabsolute; bottom: 32px; right: 100px; font-size: 18px; } img.cma-thumbnail { max-height: 100px; width: auto; vertical-align: top; } img.cma-screenshot { margin: 10px 0 0 25px; max-width: 800px; height: auto; vertical-align: top; border: 1px\r\nsolid #000; } div.cma-screenshot-text { margin: 10px 0 0 25px; } .cma-break-word { word-wrap: break-word; } .cma-tag {\r\nborder-radius: 5px; padding: 1px 10px; margin-right: 10px; } .cma-tag-info { background: #f0f0f0; } .cma-tag-warning {\r\nbackground: #ffdead; }\r\nNotification\r\nThis report is provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not\r\nprovide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial\r\nproduct or service referenced in this bulletin or otherwise.\r\nThis document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries\r\nminimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to\r\nstandard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the\r\nTraffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.\r\nSummary\r\nDescription\r\nSix files were submitted for analysis. The files were identified as DearCry ransomware. The malware encrypts files on a\r\ndevice and demands ransom in exchange for decryption.\r\nFor a downloadable copy of IOCs, see: MAR-10330097-1.v1.stix.\r\nEmails (2)\r\nkonedieyp[@]airmail.cc\r\nuenwonken[@]memail.com\r\nSubmitted Files (6)\r\n027119161d11ba87acc908a1d284b93a6bcafccc012e52ce390ecb9cd745bf27 (027119161d11ba87acc908a1d284b9...)\r\n10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da (10bce0ff6597f347c3cca8363b7c81...)\r\n2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff (2b9838da7edb0decd32b086e47a31e...)\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 1 of 26\n\ne044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6 (e044d9f2d0f1260c3f4a543a1e67f3...)\r\nfdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65 (fdec933ca1dd1387d970eeea32ce5d...)\r\nfeb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede (feb3e6d30ba573ba23f3bd1291ca17...)\r\nFindings\r\n2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\r\nTags\r\ndownloaderloaderransomwaretrojan\r\nDetails\r\nName 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\r\nSize 1322496 bytes\r\nType PE32 executable (console) Intel 80386, for MS Windows\r\nMD5 0e55ead3b8fd305d9a54f78c7b56741a\r\nSHA1 f7b084e581a8dcea450c2652f8058d93797413c3\r\nSHA256 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\r\nSHA512 5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa7\r\nssdeep 24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkHVZgMCS+:L7XP7P9o5QzUtl1fpxkHVZgMC3\r\nEntropy 6.994611\r\nAntivirus\r\nAhnlab Ransomware/Win.DoejoCrypt\r\nAntiy Trojan[Ransom]/Win32.DearCry\r\nAvira TR/FileCoder.HW\r\nBitDefender Trojan.GenericKD.36477740\r\nClamAV Win.Ransomware.Dearcry-9840778-0\r\nComodo Malware\r\nCyren W32/Trojan.FOGJ-5046\r\nESET a variant of Win32/Filecoder.DearCry.A trojan\r\nEmsisoft Trojan.GenericKD.36477740 (B)\r\nIkarus Trojan-Ransom.FileCrypter\r\nK7 Trojan ( 005790de1 )\r\nLavasoft Trojan.GenericKD.36477740\r\nMcAfee Ransom-DearCry!0E55EAD3B8FD\r\nMicrosoft Security Essentials Ransom:Win32/DoejoCrypt.A\r\nNANOAV Trojan.Win32.Encoder.ipilfs\r\nNetGate Trojan.Win32.Malware\r\nQuick Heal Ransom.DearCry.S19261705\r\nSophos Troj/Ransom-GFE\r\nSymantec Downloader\r\nTACHYON Ransom/W32.DearCry.1322496\r\nTrendMicro Ransom.56DC2A23\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 2 of 26\n\nTrendMicro House Call Ransom.56DC2A23\r\nVir.IT eXplorer Ransom.Win32.DearCry.CUQ\r\nVirusBlokAda TrojanRansom.Encoder\r\nZillya! Trojan.Encoder.Win32.2195\r\nYARA Rules\r\nrule CISA_10330097_01 : trojan downloader ransomware DEARCRY\r\n{\r\n   meta:\r\n       Author = \"CISA Code \u0026 Media Analysis\"\r\n       Incident = \"10330097\"\r\n       Date = \"2021-03-31\"\r\n       Last_Modified = \"20210331_1630\"\r\n       Actor = \"n/a\"\r\n       Category = \"Trojan Downloader Ransomware\"\r\n       Family = \"DEARCRY\"\r\n       Description = \"Detects DearCry Ransomware\"\r\n       MD5_1 = \"0e55ead3b8fd305d9a54f78c7b56741a\"\r\n       SHA256_1 = \"2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\"\r\n       MD5_2 = \"cdda3913408c4c46a6c575421485fa5b\"\r\n       SHA256_2 = \"e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\"\r\n       MD5_3 = \"c6eeb14485d93f4e30fb79f3a57518fc\"\r\n       SHA256_3 = \"feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\"\r\n   strings:\r\n       $s0 = { 8B 85 04 EA FF FF 50 8B 8D 08 EA FF FF 51 8B 55 14 52 8B 45 10 50 8D 8D 68 F0 FF FF 51 8B 95\r\n00 EA FF FF 52 }\r\n       $s1 = { 43 72 79 70 74 6F 50 72 6F 2D 58 63 68 42 }\r\n       $s2 = \"-----BEGIN RSA PUBLIC KEY-----\"\r\n       $s3 = \".CRYPT\"\r\n   condition:\r\n       all of them\r\n}\r\nssdeep Matches\r\n99 feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\r\nPE Metadata\r\nCompile Date 2021-03-09 03:08:39-05:00\r\nImport Hash f8b8e20e844ccd50a8eb73c2fca3626d\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n4289116f218aa083456871506085e1be header 1024 2.596118\r\n46c15879afc7b600a23284d8e72f87aa .text 976896 7.069452\r\nd0093b4c33543ebd59b2c22c7e71670f .rdata 265728 6.128934\r\n40f8722b3a267afab34d8909cf5da682 .data 25600 4.794047\r\na0bf446401bdd255b7f7cb0215177d73 .rsrc 512 5.108717\r\nbcd8233433c686e481a6c5a4f1f263ac .reloc 51712 5.474063\r\nPackers/Compilers/Cryptors\r\nRelationships\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 3 of 26\n\n2b9838da7e... Related_To konedieyp[@]airmail.cc\r\n2b9838da7e... Related_To uenwonken[@]memail.com\r\nDescription\r\nThis file is a 32-bit Windows executable application. This file has been identified as a variant of the DearCry Ransomware.\r\nThe ransomware attempts to encrypt specific files, identified by file extension, on the target system utilizing the Advanced\r\nEncryption Standard (AES) and Rivest–Shamir–Adleman (RSA) encryption algorithms. The ransomware contains the\r\nfollowing hard coded public RSA key, which is utilized to encrypt the target system's user files.\r\n--Begin RSA public key--\r\nMIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+C6UsAhkdI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19\r\n--End RSA public key--\r\nDuring runtime, the ransomware loads the hard-coded RSA public key. It then attempts to identify all drives that are\r\nconnected to the attached system, from Drive A: to Drive Z:. For each drive identified, the ransomware will enumerate it and\r\nencrypt files with the following file extensions:\r\n--Begin targeted file extensions--\r\n.TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS\r\n.EML .INI .CSS .HTM .HTML .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER\r\n.CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST\r\n.PGD .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS\r\n--End targeted file extensions--\r\nIt will then write the ransom note \"readme.txt\" to every folder it enumerates on the connected drive.\r\n--Begin ransom note--\r\nYour file has been encrypted!\r\n                        If you want to decrypt, please contact us.\r\n                        konedieyp[@]airmail.cc or uenwonken[@]memail.com\r\n                        And please send me the following hash!\r\n                        638428e5021d4ae247b21acf9c0bf6f6\r\n--End ransom note--\r\nNext, the ransomware will attempt to encrypt files on the target system that have the file extensions listed above. After\r\nencrypting the target system's user files the ransomware will drop the ransom note \"readme.txt\" within folders with\r\nencrypted files on the target system.\r\nThe ransomware will then delete the original copy of the files and then replace them with encrypted copies of themselves\r\nwith the file extension changed to .CRYPT. Before actually deleting the original target file, the malware will overwrite it\r\nwith the repeating value 0x41 in order to make recovery of the file using computer forensics software impossible.\r\nBefore encrypting the target system's user files the malware will encrypt information about the files, including the file's full\r\npath and the AES key used to encrypt it, which will also be used to decrypt it. This data will be encrypted using the hard\r\ncoded Public RSA key mentioned above, and added to the top of the encrypted file. Note: The ransomware will generate a\r\nnew AES key for every file.\r\nDuring execution, the ransomware runs a service named “msupdate.\" After the encryption process and installing the ransom\r\nnote, the “msupdate\" service is removed, which could indicate that the ransomware was executed under the Windows\r\n\"msupdate\" service.\r\nIllustrated below are strings of interest extracted from this binary. These strings indicate the encryption process of the target\r\nsystem's user files is implemented utilizing the OPENSSL library:\r\n--Begin strings of interest--\r\ncrypto\\evp\\e_aes.c\r\ncrypto\\bio\\bio_lib.c\r\ncrypto\\rsa\\rsa_lib.c\r\ncrypto\\evp\\evp_enc.c\r\nassertion failed: bl \u003c= (int)sizeof(ctx-\u003ebuf)\r\nassertion failed: b \u003c= sizeof ctx-\u003ebuf\r\nassertion failed: b \u003c= sizeof ctx-\u003efinal\r\nassertion failed: EVP_CIPHER_CTX_iv_length(ctx) \u003c= (int)sizeof(ctx-\u003eiv)\r\nassertion failed: ctx-\u003ecipher-\u003eblock_size == 1 || ctx-\u003ecipher-\u003eblock_size == 8 || ctx-\u003ecipher-\u003eblock_size == 16\r\n%lu:%s:%s:%d:%s\r\nsecure memory buffer\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 4 of 26\n\nmemory buffer\r\ncrypto\\bio\\bss_mem.c\r\nCERTIFICATE REQUEST\r\nNEW CERTIFICATE REQUEST\r\nPKCS7\r\nCERTIFICATE\r\nRSA PUBLIC KEY\r\nDH PARAMETERS\r\nX9.42 DH PARAMETERS\r\ncrypto\\rsa\\rsa_crpt.c\r\ncrypto\\evp\\evp_lib.c\r\nassertion failed: l \u003c= sizeof(c-\u003eiv)\r\nassertion failed: j \u003c= sizeof(c-\u003eiv)\r\ninit fail\r\ncalled a function that was disabled at compile-time\r\ninternal error\r\npassed a null parameter\r\ncalled a function you should not call\r\nmalloc failure\r\nfatal\r\nmissing asn1 eos\r\nnested asn1 error\r\nECDSA lib\r\nENGINE lib\r\nX509V3 lib\r\nPKCS7 lib\r\nBIO lib\r\nEC lib\r\nASN1 lib\r\nX509 lib\r\nDSA lib\r\nPEM lib\r\nOBJ lib\r\nBUF lib\r\nEVP lib\r\nDH lib\r\nRSA lib\r\nBN lib\r\nsystem lib\r\ngethostbyname\r\ngetsockname\r\ngetsockopt\r\nsetsockopt\r\ngetnameinfo\r\ngetaddrinfo\r\nfread\r\nopendir\r\nWSAstartup\r\naccept\r\nlisten\r\nbind\r\nioctlsocket\r\nsocket\r\ngetservbyname\r\nconnect\r\nfopen\r\nKDF routines\r\nASYNC routines\r\nCT routines\r\nHMAC routines\r\nCMS routines\r\nFIPS routines\r\nOCSP routines\r\nengine routines\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 5 of 26\n\ntime stamp routines\r\nDSO support routines\r\nrandom number generator\r\nPKCS12 routines\r\nX509 V3 routines\r\nPKCS7 routines\r\nBIO routines\r\nSSL routines\r\nECDH routines\r\nECDSA routines\r\nelliptic curve routines\r\ncommon libcrypto routines\r\nconfiguration file routines\r\nasn1 encoding routines\r\nx509 certificate routines\r\ndsa routines\r\nPEM routines\r\nobject identifier routines\r\nmemory buffer routines\r\ndigital envelope routines\r\nDiffie-Hellman routines\r\nrsa routines\r\nbignum routines\r\nsystem library\r\nunknown library\r\nunknown\r\ncrypto\\err\\err.c\r\nerror:%08lX:%s:%s:%s\r\nreason(%lu)\r\nfunc(%lu)\r\nlib(%lu)\r\ncrypto\\modes\\ocb128.c\r\ncrypto\\threads_win.c\r\ncrypto\\ex_data.c\r\nOpenSSL PKCS#1 RSA (from Eric Young)\r\ncrypto\\rsa\\rsa_ossl.c\r\ncrypto\\engine\\eng_init.c\r\ncrypto\\bn\\bn_blind.c\r\ncrypto\\bn\\bn_lib.c\r\n%I64i\r\nOPENSSL_ia32cap\r\nService-0x\r\n_OPENSSL_isservice\r\nOpenSSL: FATAL\r\nOpenSSL\r\nno stack?\r\n%s:%d: OpenSSL internal error: %s\r\ncrypto\\engine\\tb_cipher.c\r\n?assertion failed: *sbuffer != NULL\r\nassertion failed: *currlen \u003c= *maxlen\r\nassertion failed: *sbuffer != NULL || buffer != NULL\r\ncrypto\\bio\\b_print.c\r\n\u003cNULL\u003e\r\n0123456789abcdef\r\n0123456789ABCDEF\r\n0123456789\r\nA-C\r\n?FILE pointer\r\ncrypto\\bio\\bss_file.c\r\nfopen('\r\n','\r\ncrypto\\buffer\\buffer.c\r\n@@You need to read the OpenSSL FAQ, https://www.openssl.org/docs/faq.html\r\n....................\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 6 of 26\n\ncrypto\\rand\\md_rand.c\r\ncrypto\\pem\\pem_oth.c\r\nX509_REQ\r\nsignature\r\nsig_alg\r\nreq_info\r\nX509_REQ_INFO\r\nattributes\r\npubkey\r\nsubject\r\nversion\r\n0123456789ABCDEF\r\nProc-Type:\r\nENCRYPTED\r\nDEK-Info:\r\ncrypto\\pem\\pem_lib.c\r\nphrase is too short, needs to be at least %d chars\r\nEnter PEM pass phrase:\r\nProc-Type: 4,\r\nBAD-TYPE\r\nMIC-ONLY\r\nMIC-CLEAR\r\nENCRYPTED\r\nDEK-Info:\r\n-----END\r\n-----\r\n-----BEGIN\r\nCMS\r\nPKCS #7 SIGNED DATA\r\nTRUSTED CERTIFICATE\r\nX509 CERTIFICATE\r\nPARAMETERS\r\nPRIVATE KEY\r\nENCRYPTED PRIVATE KEY\r\nANY PRIVATE KEY\r\nassertion failed: strlen(objstr) + 23 + 2 * EVP_CIPHER_iv_length(enc) + 13 \u003c= sizeof buf\r\nassertion failed: EVP_CIPHER_iv_length(enc) \u003c= (int)sizeof(iv)\r\nExpecting:\r\nX509_CRL\r\ncrl\r\nX509_CRL_INFO\r\nrevoked\r\nnextUpdate\r\nlastUpdate\r\nissuer\r\nX509_REVOKED\r\nextensions\r\nrevocationDate\r\nserialNumber\r\nPKCS7_ATTR_VERIFY\r\nPKCS7_ATTR_SIGN\r\nPKCS7_ATTRIBUTES\r\nPKCS7_DIGEST\r\ndigest\r\nPKCS7_ENCRYPT\r\nPKCS7_SIGN_ENVELOPE\r\nPKCS7_ENC_CONTENT\r\nalgorithm\r\ncontent_type\r\nPKCS7_RECIP_INFO\r\nenc_key\r\nkey_enc_algor\r\nPKCS7_ENVELOPE\r\nenc_data\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 7 of 26\n\nrecipientinfo\r\nPKCS7_ISSUER_AND_SERIAL\r\nserial\r\nPKCS7_SIGNER_INFO\r\nunauth_attr\r\nenc_digest\r\ndigest_enc_alg\r\nauth_attr\r\ndigest_alg\r\nissuer_and_serial\r\nPKCS7_SIGNED\r\nsigner_info\r\ncert\r\ncontents\r\nmd_algs\r\ntype\r\nd.encrypted\r\nd.digest\r\nd.signed_and_enveloped\r\nd.enveloped\r\nd.sign\r\nd.data\r\nd.other\r\nNETSCAPE_CERT_SEQUENCE\r\ncerts\r\ncrypto\\evp\\p_lib.c\r\n%s algorithm \"%s\" unsupported\r\nPublic Key\r\ncrypto\\pem\\pem_pkey.c\r\nRSA_OAEP_PARAMS\r\npSourceFunc\r\nmaskGenFunc\r\nhashFunc\r\nRSA_PSS_PARAMS\r\ntrailerField\r\nsaltLength\r\nmaskGenAlgorithm\r\nhashAlgorithm\r\nRSA\r\nX509_PUBKEY\r\npublic_key\r\nalgor\r\nH/O\r\n\u003c/O\r\nh/O\r\nP/O\r\n0/O\r\ncrypto\\x509\\x_pubkey.c\r\ncrypto\\dsa\\dsa_lib.c\r\nDSA\r\npriv_key\r\npub_key\r\nDSA_SIG\r\ncrypto\\dsa\\dsa_asn1.c\r\ncrypto\\ec\\ec_key.c\r\nassertion failed: eckey-\u003egroup-\u003emeth-\u003ekeygen != NULL\r\nECDSA_SIG\r\nEC_PRIVATEKEY\r\npublicKey\r\nparameters\r\nprivateKey\r\nECPKPARAMETERS\r\nvalue.implicitlyCA\r\nvalue.parameters\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 8 of 26\n\nvalue.named_curve\r\nECPARAMETERS\r\ncofactor\r\norder\r\nbase\r\ncurve\r\nfieldID\r\nX9_62_CURVE\r\nseed\r\nX9_62_FIELDID\r\nfieldType\r\np.char_two\r\np.prime\r\nX9_62_CHARACTERISTIC_TWO\r\np.ppBasis\r\np.tpBasis\r\np.onBasis\r\np.other\r\nX9_62_PENTANOMIAL\r\ncertificate extensions\r\nset-certExt\r\nset-policy\r\nset-attr\r\nmessage extensions\r\nset-msgExt\r\ncontent types\r\nset-ctype\r\nSecure Electronic Transactions\r\nid-set\r\npseudonym\r\ngenerationQualifier\r\nid-hex-multipart-message\r\nid-hex-partial-message\r\nmime-mhs-bodies\r\nmime-mhs-headings\r\nMIME MHS\r\nmime-mhs\r\nx500UniqueIdentifier\r\ndocumentPublisher\r\naudio\r\ndITRedirect\r\npersonalSignature\r\nsubtreeMaximumQuality\r\nsubtreeMinimumQuality\r\nsingleLevelQuality\r\ndSAQuality\r\nbuildingName\r\nmailPreferenceOption\r\njanetMailbox\r\norganizationalStatus\r\nfriendlyCountryName\r\npagerTelephoneNumber\r\nmobileTelephoneNumber\r\npersonalTitle\r\nhomePostalAddress\r\nassociatedName\r\nassociatedDomain\r\ncNAMERecord\r\nsOARecord\r\nnSRecord\r\nmXRecord\r\npilotAttributeType27\r\naRecord\r\nlastModifiedBy\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 9 of 26\n\nlastModifiedTime\r\notherMailbox\r\nsecretary\r\nhomeTelephoneNumber\r\ndocumentLocation\r\ndocumentAuthor\r\ndocumentVersion\r\ndocumentTitle\r\ndocumentIdentifier\r\nmanager\r\nhost\r\nuserClass\r\nphoto\r\nroomNumber\r\nfavouriteDrink\r\ninfo\r\nrfc822Mailbox\r\nmail\r\ntextEncodedORAddress\r\nuserId\r\nUID\r\nqualityLabelledData\r\npilotDSA\r\npilotOrganization\r\nsimpleSecurityObject\r\nfriendlyCountry\r\ndomainRelatedObject\r\ndNSDomain\r\nrFC822localPart\r\ndocumentSeries\r\nroom\r\ndocument\r\naccount\r\npilotPerson\r\npilotObject\r\ncaseIgnoreIA5StringSyntax\r\niA5StringSyntax\r\npilotGroups\r\npilotObjectClass\r\npilotAttributeSyntax\r\npilotAttributeType\r\npilot\r\nucl\r\npss\r\ndata\r\nHold Instruction Reject\r\nholdInstructionReject\r\nHold Instruction Call Issuer\r\nholdInstructionCallIssuer\r\nHold Instruction None\r\nholdInstructionNone\r\nHold Instruction Code\r\nholdInstructionCode\r\naes-256-cfb\r\nAES-256-CFB\r\naes-256-ofb\r\nAES-256-OFB\r\naes-256-cbc\r\nAES-256-CBC\r\naes-256-ecb\r\nAES-256-ECB\r\naes-192-cfb\r\nAES-192-CFB\r\naes-192-ofb\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 10 of 26\n\nAES-192-OFB\r\naes-192-cbc\r\nAES-192-CBC\r\naes-192-ecb\r\nAES-192-ECB\r\naes-128-cfb\r\nAES-128-CFB\r\naes-128-ofb\r\nAES-128-OFB\r\naes-128-cbc\r\nAES-128-CBC\r\naes-128-ecb\r\nAES-128-ECB\r\nMicrosoft CSP Name\r\nCSPName\r\necdsa-with-SHA1\r\nprime256v1\r\nprime239v3\r\nprime239v2\r\nprime239v1\r\nprime192v3\r\nprime192v2\r\nprime192v1\r\nid-ecPublicKey\r\ncharacteristic-two-field\r\nprime-field\r\nANSI X9.62\r\nansi-X9-62\r\nX509v3 No Revocation Available\r\nnoRevAvail\r\nX509v3 AC Targeting\r\ntargetInformation\r\nX509v3 Policy Constraints\r\npolicyConstraints\r\nrole\r\nid-aca-encAttrs\r\nSubject Information Access\r\nsubjectInfoAccess\r\nac-proxying\r\nmd4WithRSAEncryption\r\nRSA-MD4\r\nclearance\r\nSelected Attribute Types\r\nselected-attribute-types\r\nDomain\r\ndomain\r\ndomainComponent\r\ndcObject\r\ndcobject\r\nEnterprises\r\nenterprises\r\nMail\r\nSNMPv2\r\nsnmpv2\r\nSecurity\r\nsecurity\r\nPrivate\r\nprivate\r\nExperimental\r\nexperimental\r\nManagement\r\nmgmt\r\nDirectory\r\ndirectory\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 11 of 26\n\niana\r\nIANA\r\ndod\r\nDOD\r\norg\r\nORG\r\ndirectory services - algorithms\r\nX500algorithms\r\nrsaSignature\r\nTrust Root\r\ntrustRoot\r\npath\r\nvalid\r\nExtended OCSP Status\r\nextendedStatus\r\nOCSP Service Locator\r\nserviceLocator\r\nOCSP Archive Cutoff\r\narchiveCutoff\r\nOCSP No Check\r\nnoCheck\r\nAcceptable OCSP Responses\r\nacceptableResponses\r\nOCSP CRL ID\r\nCrlID\r\nOCSP Nonce\r\nNonce\r\nBasic OCSP Response\r\nbasicOCSPResponse\r\nad dvcs\r\nAD_DVCS\r\nAD Time Stamping\r\nad_timestamping\r\nid-cct-PKIResponse\r\nid-cct-PKIData\r\nid-cct-crs\r\nid-qcs-pkixQCSyntax-v1\r\nid-aca-role\r\nid-aca-group\r\nid-aca-chargingIdentity\r\nid-aca-accessIdentity\r\nid-aca-authenticationInfo\r\nid-pda-countryOfResidence\r\nid-pda-countryOfCitizenship\r\nid-pda-gender\r\nid-pda-placeOfBirth\r\nid-pda-dateOfBirth\r\nid-on-personalData\r\nid-cmc-confirmCertAcceptance\r\nid-cmc-popLinkWitness\r\nid-cmc-popLinkRandom\r\nid-cmc-queryPending\r\nid-cmc-responseInfo\r\nid-cmc-regInfo\r\nid-cmc-revokeRequest\r\ncrypto\\asn1\\tasn_enc.c\r\ncrypto\\asn1\\tasn_new.c\r\ncrypto\\asn1\\tasn_fre.c\r\ncrypto\\asn1\\a_dup.c\r\nassertion failed: niv \u003c= EVP_MAX_IV_LENGTH\r\nassertion failed: nkey \u003c= EVP_MAX_KEY_LENGTH\r\ncrypto\\evp\\evp_key.c\r\nABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\r\n?456789:;\u003c=\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 12 of 26\n\n!\"#$%\u0026'()*+,-./0123\r\ncrypto\\evp\\encode.c\r\nassertion failed: ctx-\u003elength \u003c= (int)sizeof(ctx-\u003eenc_data)\r\nassertion failed: n \u003c (int)sizeof(ctx-\u003eenc_data)\r\ncrypto\\asn1\\ameth_lib.c\r\nX509_EXTENSIONS\r\nExtension\r\nX509_EXTENSION\r\ncritical\r\n--End strings of interest--\r\nScreenshots\r\nFigure 1 - Screenshot of the data that will be prepended to an encrypted file. This data will contain an AES key that can be\r\nused to decrypt the file, as well as the full path of the file. This block will be encrypted via the hard-coded RSA key before it\r\nis prepended to the newly encrypted files. The ransomware will generate a new AES key for each file it encrypts.\r\nFigure 2 - Screenshot of data after it is encrypted using the malware's hard-coded RSA key.\r\nFigure 3 - Screenshot of the header of an encrypted file after the encrypted AES key and the full path of the file data is\r\nappended.\r\nFigure 4 - The ransomware enumerating all drives attached to the target system.\r\nFigure 5 - The ransomware writing the ransom note \"readme.txt\" to a directory after it encrypts contents of a directory.\r\nFigure 6 - The ransomware deleting the \"msupdate\" service after encryption of the target system's files complete.\r\nkonedieyp[@]airmail.cc\r\nTags\r\nransomware\r\nDetails\r\nAddress konedieyp[@]airmail.cc\r\nRelationships\r\nkonedieyp[@]airmail.cc Related_To 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\r\nkonedieyp[@]airmail.cc Related_To fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65\r\nkonedieyp[@]airmail.cc Related_To 027119161d11ba87acc908a1d284b93a6bcafccc012e52ce390ecb9cd745bf27\r\nkonedieyp[@]airmail.cc Related_To e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\r\nkonedieyp[@]airmail.cc Related_To feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\r\nkonedieyp[@]airmail.cc Related_To 10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da\r\nDescription\r\nThe DearCry ransomware samples contain this email address in the ransom note as a contact for decrypting files.\r\nuenwonken[@]memail.com\r\nTags\r\nransomware\r\nDetails\r\nAddress uenwonken[@]memail.com\r\nRelationships\r\nuenwonken[@]memail.com Related_To 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 13 of 26\n\nuenwonken[@]memail.com Related_To fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65\r\nuenwonken[@]memail.com Related_To 027119161d11ba87acc908a1d284b93a6bcafccc012e52ce390ecb9cd745bf27\r\nuenwonken[@]memail.com Related_To e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\r\nuenwonken[@]memail.com Related_To feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\r\nuenwonken[@]memail.com Related_To 10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da\r\nDescription\r\nThe DearCry ransomware samples contain this email address in the ransom note as a contact for decrypting files.\r\nfdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65\r\nTags\r\nransomwaretrojan\r\nDetails\r\nName fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65\r\nSize 1322521 bytes\r\nType PE32 executable (console) Intel 80386, for MS Windows\r\nMD5 6be28a4523984698e7154671f73361bf\r\nSHA1 b974375ef0f6dcb6ce30558df2ed8570bf1ad642\r\nSHA256 fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65\r\nSHA512 c3a44431e8cbb76d75ea2a1caca6fe77dfbd2a9565da918620433d415d396c08394ecb1c6454fc69661d61683711e53b60a69435e25518a04e81\r\nssdeep 24576:C5Nv2SkWFP/529IC8u2bAs0NIzkQS+KpPbEasBY2iKDl1fpxkLVZgMCST:oB70s9yjE62iIl1fpxkLVZgMCA\r\nEntropy 6.994288\r\nAntivirus\r\nAhnlab Ransomware/Win.DoejoCrypt\r\nAntiy Trojan[Ransom]/Win32.Encoder\r\nAvira TR/AD.DearcryRansom.dneew\r\nBitDefender Gen:Heur.Mint.Zard.46\r\nClamAV Win.Ransomware.Dearcry-9840778-0\r\nComodo Malware\r\nCyren W32/Ransom.TNVJ-5084\r\nESET a variant of Win32/Filecoder.DearCry.A trojan\r\nEmsisoft Gen:Heur.Mint.Zard.46 (B)\r\nIkarus Trojan-Ransom.FileCrypter\r\nK7 Trojan ( 005790ee1 )\r\nLavasoft Gen:Heur.Mint.Zard.46\r\nMcAfee Ransom-DearCry!6BE28A452398\r\nMicrosoft Security Essentials Ransom:Win32/DoejoCrypt.A\r\nNANOAV Trojan.Win32.Encoder.ioxcpd\r\nQuick Heal Ransom.DearCry.S19261705\r\nSophos Troj/Ransom-GFE\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 14 of 26\n\nSymantec Ransom.Dearcry\r\nSystweak trojan-ransom.dearcry\r\nTACHYON Ransom/W32.DearCry.1322521\r\nTrendMicro Ransom.53933CA6\r\nTrendMicro House Call Ransom.53933CA6\r\nVir.IT eXplorer Ransom.Win32.DearCry.CUQ\r\nVirusBlokAda TrojanRansom.Encoder\r\nZillya! Trojan.Filecoder.Win32.18026\r\nYARA Rules\r\nrule CISA_10330097_01 : trojan downloader ransomware DEARCRY\r\n{\r\n   meta:\r\n       Author = \"CISA Code \u0026 Media Analysis\"\r\n       Incident = \"10330097\"\r\n       Date = \"2021-03-31\"\r\n       Last_Modified = \"20210331_1630\"\r\n       Actor = \"n/a\"\r\n       Category = \"Trojan Downloader Ransomware\"\r\n       Family = \"DEARCRY\"\r\n       Description = \"Detects DearCry Ransomware\"\r\n       MD5_1 = \"0e55ead3b8fd305d9a54f78c7b56741a\"\r\n       SHA256_1 = \"2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\"\r\n       MD5_2 = \"cdda3913408c4c46a6c575421485fa5b\"\r\n       SHA256_2 = \"e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\"\r\n       MD5_3 = \"c6eeb14485d93f4e30fb79f3a57518fc\"\r\n       SHA256_3 = \"feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\"\r\n   strings:\r\n       $s0 = { 8B 85 04 EA FF FF 50 8B 8D 08 EA FF FF 51 8B 55 14 52 8B 45 10 50 8D 8D 68 F0 FF FF 51 8B 95\r\n00 EA FF FF 52 }\r\n       $s1 = { 43 72 79 70 74 6F 50 72 6F 2D 58 63 68 42 }\r\n       $s2 = \"-----BEGIN RSA PUBLIC KEY-----\"\r\n       $s3 = \".CRYPT\"\r\n   condition:\r\n       all of them\r\n}\r\nssdeep Matches\r\nNo matches found.\r\nPE Metadata\r\nCompile Date 2021-03-08 01:29:05-05:00\r\nImport Hash f8b8e20e844ccd50a8eb73c2fca3626d\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n19c89970662b40d47561bb17377abe08 header 1024 2.591397\r\n07abe3c7ee0a03e132be7d8e50cb59b3 .text 976896 7.069141\r\n7133c887704081b6d3678f691a6754fe .rdata 265728 6.128972\r\nbef1589c6181fa392609e904f4410443 .data 26112 4.707707\r\na0bf446401bdd255b7f7cb0215177d73 .rsrc 512 5.108717\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 15 of 26\n\nMD5 Name Raw Size Entropy\r\nf3d5e7499f330d470ed5e0dd856b599c .reloc 51712 5.474130\r\nPackers/Compilers/Cryptors\r\nRelationships\r\nfdec933ca1... Related_To konedieyp[@]airmail.cc\r\nfdec933ca1... Related_To uenwonken[@]memail.com\r\nDescription\r\nThis file is a malicious 32-bit Windows executable. It has been identified as a variant of the DearCry ransomware and is\r\nsimilar in design and functionality to the file 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.\r\nThe hard-coded RSA key contained within this binary is illustrated below.\r\n--Begin RSA public key--\r\nMIIBCAKCAQEA5+mVBe75OvCzCW4oZHl7vqPwV2O4kgzgfp9odcL9LZc8Gy2+NJPDwrHbttKI3z4Yt3G04lX7bEp1RZjxUYfzX8qvaPC2EBduOjS\r\n--End RSA public key--\r\nThis ransomware provides the following ransom note within directories of encrypted files on the target system and shared\r\ndrives:\r\n--Begin ransom note--\r\nYour file has been encrypted!\r\n                        If you want to decrypt, please contact us.\r\n                        konedieyp[@]airmail.cc or uenwonken[@]memail.com\r\n                        And please send me the following hash!\r\n                        d37fc1eabc6783a418d23a8d2ba5db5a\r\n--End ransom note--\r\n027119161d11ba87acc908a1d284b93a6bcafccc012e52ce390ecb9cd745bf27\r\nTags\r\nransomwaretrojan\r\nDetails\r\nName 027119161d11ba87acc908a1d284b93a6bcafccc012e52ce390ecb9cd745bf27\r\nSize 1322496 bytes\r\nType PE32 executable (console) Intel 80386, for MS Windows\r\nMD5 a7e571312e05d547936aab18f0b30fbf\r\nSHA1 e0d643e759b2adf736b451aff9afa92811ab8a99\r\nSHA256 027119161d11ba87acc908a1d284b93a6bcafccc012e52ce390ecb9cd745bf27\r\nSHA512 20e8af2770aa1be935f7d1b74d6db6f9aeb5aebab016ac6c2e58e60b1b5c9029726fda7b75ed003bf4a1a5a480024231c6a90f5a3d812bf2438dc\r\nssdeep 24576:C5Nv2SkWFP/529IC8u2bAs0NIzkQS+KpPbEasBY2iKDl1fpxkLVZgMCSZ:oB70s9yjE62iIl1fpxkLVZgMCk\r\nEntropy 6.994270\r\nAntivirus\r\nAhnlab Ransomware/Win.DoejoCrypt\r\nAvira TR/AD.DearcryRansom.dneew\r\nBitDefender Gen:Heur.Mint.Zard.46\r\nClamAV Win.Ransomware.Dearcry-9840778-0\r\nComodo Malware\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 16 of 26\n\nCyren W32/Trojan.UHTA-2594\r\nESET a variant of Win32/Filecoder.DearCry.A trojan\r\nEmsisoft Gen:Heur.Mint.Zard.46 (B)\r\nIkarus Trojan-Ransom.FileCrypter\r\nK7 Trojan ( 005790ee1 )\r\nLavasoft Gen:Heur.Mint.Zard.46\r\nMcAfee Ransom-DearCry!A7E571312E05\r\nMicrosoft Security Essentials Ransom:Win32/DoejoCrypt.A\r\nNANOAV Trojan.Win32.Encoder.ioxcpd\r\nQuick Heal Ransom.DearCry.S19261705\r\nSophos Troj/Ransom-GFE\r\nSymantec Unavailable (production)\r\nSystweak trojan-ransom.dearcry\r\nTACHYON Ransom/W32.DearCry.1322496\r\nTrendMicro Ransom.FC206072\r\nTrendMicro House Call Ransom.FC206072\r\nVir.IT eXplorer Ransom.Win32.DearCry.CUQ\r\nVirusBlokAda TrojanRansom.Encoder\r\nZillya! Trojan.Filecoder.Win32.18026\r\nYARA Rules\r\nrule CISA_10330097_01 : trojan downloader ransomware DEARCRY\r\n{\r\n   meta:\r\n       Author = \"CISA Code \u0026 Media Analysis\"\r\n       Incident = \"10330097\"\r\n       Date = \"2021-03-31\"\r\n       Last_Modified = \"20210331_1630\"\r\n       Actor = \"n/a\"\r\n       Category = \"Trojan Downloader Ransomware\"\r\n       Family = \"DEARCRY\"\r\n       Description = \"Detects DearCry Ransomware\"\r\n       MD5_1 = \"0e55ead3b8fd305d9a54f78c7b56741a\"\r\n       SHA256_1 = \"2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\"\r\n       MD5_2 = \"cdda3913408c4c46a6c575421485fa5b\"\r\n       SHA256_2 = \"e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\"\r\n       MD5_3 = \"c6eeb14485d93f4e30fb79f3a57518fc\"\r\n       SHA256_3 = \"feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\"\r\n   strings:\r\n       $s0 = { 8B 85 04 EA FF FF 50 8B 8D 08 EA FF FF 51 8B 55 14 52 8B 45 10 50 8D 8D 68 F0 FF FF 51 8B 95\r\n00 EA FF FF 52 }\r\n       $s1 = { 43 72 79 70 74 6F 50 72 6F 2D 58 63 68 42 }\r\n       $s2 = \"-----BEGIN RSA PUBLIC KEY-----\"\r\n       $s3 = \".CRYPT\"\r\n   condition:\r\n       all of them\r\n}\r\nssdeep Matches\r\nNo matches found.\r\nPE Metadata\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 17 of 26\n\nCompile Date 2021-03-08 01:29:05-05:00\r\nImport Hash f8b8e20e844ccd50a8eb73c2fca3626d\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n19c89970662b40d47561bb17377abe08 header 1024 2.591397\r\n07abe3c7ee0a03e132be7d8e50cb59b3 .text 976896 7.069141\r\n7133c887704081b6d3678f691a6754fe .rdata 265728 6.128972\r\nbef1589c6181fa392609e904f4410443 .data 26112 4.707707\r\na0bf446401bdd255b7f7cb0215177d73 .rsrc 512 5.108717\r\nf3d5e7499f330d470ed5e0dd856b599c .reloc 51712 5.474130\r\nPackers/Compilers/Cryptors\r\nRelationships\r\n027119161d... Related_To konedieyp[@]airmail.cc\r\n027119161d... Related_To uenwonken[@]memail.com\r\nDescription\r\nThis file is a malicious 32-bit Windows executable. It has been identified as a variant of the DearCry ransomware and is\r\nsimilar in design and functionality to the file 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.\r\nThe hard-coded RSA key contained within this binary is illustrated below.\r\n--Begin RSA public key--\r\nMIIBCAKCAQEA5+mVBe75OvCzCW4oZHl7vqPwV2O4kgzgfp9odcL9LZc8Gy2+NJPDwrHbttKI3z4Yt3G04lX7bEp1RZjxUYfzX8qvaPC2EBduOjS\r\n--End RSA public key--\r\nThis ransomware provides the following ransom note within directories of encrypted files on the target system and shared\r\ndrives:\r\n--Begin ransom note--\r\nYour file has been encrypted!\r\n                        If you want to decrypt, please contact us.\r\n                        konedieyp[@]airmail.cc or uenwonken[@]memail.com\r\n                        And please send me the following hash!\r\n                        d37fc1eabc6783a418d23a8d2ba5db5a\r\n--End ransom note--\r\ne044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\r\nTags\r\ndownloaderloaderransomwaretrojan\r\nDetails\r\nName e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\r\nSize 1322496 bytes\r\nType PE32 executable (console) Intel 80386, for MS Windows\r\nMD5 cdda3913408c4c46a6c575421485fa5b\r\nSHA1 56eec7392297e7301159094d7e461a696fe5b90f\r\nSHA256 e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\r\nSHA512 666b7419adaa2fba34e53416fc29cac92bbbe36d9fae57bae00001d644f35484df9b1e44a516866b000b8ab04cd2241414fe0692e1a5b6f36d540\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 18 of 26\n\nssdeep 24576:C5Nv2SkWFP/529IC8u2bAs0NIzkQS+KpPbEasBY2iKDl1fpxkLVZgMCS+:oB70s9yjE62iIl1fpxkLVZgMC3\r\nEntropy 6.994272\r\nAntivirus\r\nAhnlab Ransomware/Win.DoejoCrypt\r\nAntiy Trojan[Ransom]/Win32.Encoder\r\nAvira TR/AD.DearcryRansom.dneew\r\nBitDefender Gen:Heur.Mint.Zard.46\r\nClamAV Win.Ransomware.Dearcry-9840778-0\r\nComodo Malware\r\nCyren W32/Trojan.UHSB-2594\r\nESET a variant of Win32/Filecoder.DearCry.A trojan\r\nEmsisoft Gen:Heur.Mint.SP.Ransom.Dearcry.1 (B)\r\nIkarus Trojan-Ransom.FileCrypter\r\nK7 Trojan ( 005790ee1 )\r\nLavasoft Gen:Heur.Mint.SP.Ransom.Dearcry.1\r\nMcAfee Ransom-DearCry!CDDA3913408C\r\nMicrosoft Security Essentials Ransom:Win32/DoejoCrypt.A\r\nNANOAV Trojan.Win32.Encoder.ioxcpd\r\nQuick Heal Ransom.DearCry.S19261705\r\nSophos Troj/Ransom-GFE\r\nSymantec Downloader\r\nTACHYON Ransom/W32.DearCry.1322496\r\nTrendMicro Ransom.56DC2A23\r\nTrendMicro House Call Ransom.56DC2A23\r\nVir.IT eXplorer Ransom.Win32.DearCry.CUQ\r\nVirusBlokAda TrojanRansom.Encoder\r\nZillya! Trojan.Filecoder.Win32.18026\r\nYARA Rules\r\nrule CISA_10330097_01 : trojan downloader ransomware DEARCRY\r\n{\r\n   meta:\r\n       Author = \"CISA Code \u0026 Media Analysis\"\r\n       Incident = \"10330097\"\r\n       Date = \"2021-03-31\"\r\n       Last_Modified = \"20210331_1630\"\r\n       Actor = \"n/a\"\r\n       Category = \"Trojan Downloader Ransomware\"\r\n       Family = \"DEARCRY\"\r\n       Description = \"Detects DearCry Ransomware\"\r\n       MD5_1 = \"0e55ead3b8fd305d9a54f78c7b56741a\"\r\n       SHA256_1 = \"2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\"\r\n       MD5_2 = \"cdda3913408c4c46a6c575421485fa5b\"\r\n       SHA256_2 = \"e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\"\r\n       MD5_3 = \"c6eeb14485d93f4e30fb79f3a57518fc\"\r\n       SHA256_3 = \"feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\"\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 19 of 26\n\nstrings:\r\n       $s0 = { 8B 85 04 EA FF FF 50 8B 8D 08 EA FF FF 51 8B 55 14 52 8B 45 10 50 8D 8D 68 F0 FF FF 51 8B 95\r\n00 EA FF FF 52 }\r\n       $s1 = { 43 72 79 70 74 6F 50 72 6F 2D 58 63 68 42 }\r\n       $s2 = \"-----BEGIN RSA PUBLIC KEY-----\"\r\n       $s3 = \".CRYPT\"\r\n   condition:\r\n       all of them\r\n}\r\nssdeep Matches\r\nNo matches found.\r\nPE Metadata\r\nCompile Date 2021-03-08 01:29:05-05:00\r\nImport Hash f8b8e20e844ccd50a8eb73c2fca3626d\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n19c89970662b40d47561bb17377abe08 header 1024 2.591397\r\n07abe3c7ee0a03e132be7d8e50cb59b3 .text 976896 7.069141\r\n7133c887704081b6d3678f691a6754fe .rdata 265728 6.128972\r\nbef1589c6181fa392609e904f4410443 .data 26112 4.707707\r\na0bf446401bdd255b7f7cb0215177d73 .rsrc 512 5.108717\r\nf3d5e7499f330d470ed5e0dd856b599c .reloc 51712 5.474130\r\nPackers/Compilers/Cryptors\r\nRelationships\r\ne044d9f2d0... Related_To konedieyp[@]airmail.cc\r\ne044d9f2d0... Related_To uenwonken[@]memail.com\r\nDescription\r\nThis file is a malicious 32-bit Windows executable. It has been identified as a variant of the DearCry ransomware and is\r\nsimilar in design and functionality to the file 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.\r\nThe hard-coded RSA key contained within this binary is illustrated below.\r\n--Begin RSA public key--\r\nMIIBCAKCAQEA5+mVBe75OvCzCW4oZHl7vqPwV2O4kgzgfp9odcL9LZc8Gy2+NJPDwrHbttKI3z4Yt3G04lX7bEp1RZjxUYfzX8qvaPC2EBduOjS\r\n--End RSA public key--\r\nThis ransomware provides the following ransom note within directories of encrypted files on the target system and shared\r\ndrives:\r\n--Begin ransom note--\r\nYour file has been encrypted!\r\n                        If you want to decrypt, please contact us.\r\n                        konedieyp[@]airmail.cc or uenwonken[@]memail.com\r\n                        And please send me the following hash!\r\n                        d37fc1eabc6783a418d23a8d2ba5db5a\r\n--End ransom note--\r\nfeb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\r\nTags\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 20 of 26\n\ndownloaderloaderransomwaretrojan\r\nDetails\r\nName feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\r\nSize 1322496 bytes\r\nType PE32 executable (console) Intel 80386, for MS Windows\r\nMD5 c6eeb14485d93f4e30fb79f3a57518fc\r\nSHA1 b7d99521348d319f57d2b2ba7045295fc99cf6a7\r\nSHA256 feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\r\nSHA512 1cf95db6bb1b4b047ae91711c5f14c618c19ddee2465df44905e082a59c53d3aeee0e69e9aaf562ba117015e2e84ccfaed6b94d863dc6c153ba4a\r\nssdeep 24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkzVZgMCS+:L7XP7P9o5QzUtl1fpxkzVZgMC3\r\nEntropy 6.994636\r\nAntivirus\r\nAhnlab Ransomware/Win.DoejoCrypt\r\nAntiy Trojan[Ransom]/Win32.DearCry\r\nAvira TR/AD.DearcryRansom.prkjk\r\nBitDefender Trojan.GenericKD.36489973\r\nClamAV Win.Ransomware.Dearcry-9840778-0\r\nComodo Malware\r\nCyren W32/Trojan.BMMM-2027\r\nESET a variant of Win32/Filecoder.DearCry.A trojan\r\nEmsisoft Trojan.GenericKD.36489973 (B)\r\nIkarus Trojan-Ransom.FileCrypter\r\nK7 Trojan ( 005790de1 )\r\nLavasoft Trojan.GenericKD.36489973\r\nMcAfee Ransom-DearCry!C6EEB14485D9\r\nMicrosoft Security Essentials Ransom:Win32/DoejoCrypt.A\r\nNANOAV Trojan.Win32.Encoder.ipilfs\r\nQuick Heal Ransom.DearCry.S19261705\r\nSophos Troj/Ransom-GFE\r\nSymantec Downloader\r\nTACHYON Ransom/W32.DearCry.1322496\r\nTrendMicro Ransom.56DC2A23\r\nTrendMicro House Call Ransom.56DC2A23\r\nVir.IT eXplorer Ransom.Win32.DearCry.CUQ\r\nVirusBlokAda TrojanRansom.Encoder\r\nZillya! Trojan.Encoder.Win32.2195\r\nYARA Rules\r\nrule CISA_10330097_01 : trojan downloader ransomware DEARCRY\r\n{\r\n   meta:\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 21 of 26\n\nAuthor = \"CISA Code \u0026 Media Analysis\"\r\n       Incident = \"10330097\"\r\n       Date = \"2021-03-31\"\r\n       Last_Modified = \"20210331_1630\"\r\n       Actor = \"n/a\"\r\n       Category = \"Trojan Downloader Ransomware\"\r\n       Family = \"DEARCRY\"\r\n       Description = \"Detects DearCry Ransomware\"\r\n       MD5_1 = \"0e55ead3b8fd305d9a54f78c7b56741a\"\r\n       SHA256_1 = \"2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\"\r\n       MD5_2 = \"cdda3913408c4c46a6c575421485fa5b\"\r\n       SHA256_2 = \"e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\"\r\n       MD5_3 = \"c6eeb14485d93f4e30fb79f3a57518fc\"\r\n       SHA256_3 = \"feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\"\r\n   strings:\r\n       $s0 = { 8B 85 04 EA FF FF 50 8B 8D 08 EA FF FF 51 8B 55 14 52 8B 45 10 50 8D 8D 68 F0 FF FF 51 8B 95\r\n00 EA FF FF 52 }\r\n       $s1 = { 43 72 79 70 74 6F 50 72 6F 2D 58 63 68 42 }\r\n       $s2 = \"-----BEGIN RSA PUBLIC KEY-----\"\r\n       $s3 = \".CRYPT\"\r\n   condition:\r\n       all of them\r\n}\r\nssdeep Matches\r\n99 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\r\nPE Metadata\r\nCompile Date 2021-03-09 03:08:39-05:00\r\nImport Hash f8b8e20e844ccd50a8eb73c2fca3626d\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n4289116f218aa083456871506085e1be header 1024 2.596118\r\n46c15879afc7b600a23284d8e72f87aa .text 976896 7.069452\r\nd0093b4c33543ebd59b2c22c7e71670f .rdata 265728 6.128934\r\n8883af046ae6ebae63ae3882d79bfc4e .data 25600 4.793715\r\na0bf446401bdd255b7f7cb0215177d73 .rsrc 512 5.108717\r\nbcd8233433c686e481a6c5a4f1f263ac .reloc 51712 5.474063\r\nPackers/Compilers/Cryptors\r\nRelationships\r\nfeb3e6d30b... Related_To konedieyp[@]airmail.cc\r\nfeb3e6d30b... Related_To uenwonken[@]memail.com\r\nDescription\r\nThis file is a malicious 32 bit Windows executable. It has been identified as a variant of the DearCry ransomware and is\r\nsimilar in design and functionality to the file 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.\r\nThe hard-coded RSA key contained within this binary is illustrated below.\r\n--Begin RSA public key--\r\nMIIBCAKCAQEA1Qdzdr0sRv1i+hUXF6rzsLYjQ3NRuJO16S4MpmG54q5mX0TxEEh1FmkQwULatEQkDSBC1Qbi6ZNAYhvYGj4K2G2dfIexSXfaz\r\n--End RSA public key--\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 22 of 26\n\nThis ransomware provides the following ransom note within directories of encrypted files on the target system and shared\r\ndrives:\r\n--Begin ransom note--\r\nYour file has been encrypted!\r\n                        If you want to decrypt, please contact us.\r\n                        konedieyp[@]airmail.cc or uenwonken[@]memail.com\r\n                        And please send me the following hash!\r\n                        2133c369fb115ea61eebd7b62768decf\r\n--End ransom note--\r\n10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da\r\nTags\r\nransomwaretrojan\r\nDetails\r\nName 10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da\r\nSize 1322521 bytes\r\nType PE32 executable (console) Intel 80386, for MS Windows\r\nMD5 9f05994819a3d8c1a3769352c7c39d1d\r\nSHA1 eb2457196e04dfdd54f70bd32ed02ae854d45bc0\r\nSHA256 10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da\r\nSHA512 32cac848f47a0096773435c6365fcbd6bdb02115aae2677aec5a86031b6def938033210fdcf0e12f735aa5ceb8cd4be5f7edb5cdc437bbca61f0d7\r\nssdeep 24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkzVZgMCST:L7XP7P9o5QzUtl1fpxkzVZgMCA\r\nEntropy 6.994652\r\nAntivirus\r\nAhnlab Ransomware/Win.DoejoCrypt\r\nAntiy Trojan[Ransom]/Win32.DearCry\r\nAvira TR/AD.DearcryRansom.prkjk\r\nBitDefender Trojan.GenericKD.36489973\r\nClamAV Win.Ransomware.Dearcry-9840778-0\r\nComodo Malware\r\nCyren W32/Trojan.NIBO-1126\r\nESET a variant of Win32/Filecoder.DearCry.A trojan\r\nEmsisoft Trojan.GenericKD.36489973 (B)\r\nIkarus Trojan-Ransom.FileCrypter\r\nK7 Trojan ( 005790de1 )\r\nLavasoft Trojan.GenericKD.36489973\r\nMcAfee Ransom-DearCry!9F05994819A3\r\nMicrosoft Security Essentials Ransom:Win32/DoejoCrypt.A\r\nNANOAV Trojan.Win32.Encoder.ipilfs\r\nNetGate Trojan.Win32.Malware\r\nQuick Heal Ransom.DearCry.S19261705\r\nSophos Troj/Ransom-GFE\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 23 of 26\n\nSymantec Ransom.Dearcry\r\nSystweak trojan-ransom.dearcry\r\nTACHYON Ransom/W32.DearCry.1322521\r\nTrendMicro Ransom.53933CA6\r\nTrendMicro House Call Ransom.53933CA6\r\nVir.IT eXplorer Ransom.Win32.DearCry.CUQ\r\nVirusBlokAda TrojanRansom.Encoder\r\nZillya! Trojan.Encoder.Win32.2195\r\nYARA Rules\r\nrule CISA_10330097_01 : trojan downloader ransomware DEARCRY\r\n{\r\n   meta:\r\n       Author = \"CISA Code \u0026 Media Analysis\"\r\n       Incident = \"10330097\"\r\n       Date = \"2021-03-31\"\r\n       Last_Modified = \"20210331_1630\"\r\n       Actor = \"n/a\"\r\n       Category = \"Trojan Downloader Ransomware\"\r\n       Family = \"DEARCRY\"\r\n       Description = \"Detects DearCry Ransomware\"\r\n       MD5_1 = \"0e55ead3b8fd305d9a54f78c7b56741a\"\r\n       SHA256_1 = \"2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\"\r\n       MD5_2 = \"cdda3913408c4c46a6c575421485fa5b\"\r\n       SHA256_2 = \"e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\"\r\n       MD5_3 = \"c6eeb14485d93f4e30fb79f3a57518fc\"\r\n       SHA256_3 = \"feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\"\r\n   strings:\r\n       $s0 = { 8B 85 04 EA FF FF 50 8B 8D 08 EA FF FF 51 8B 55 14 52 8B 45 10 50 8D 8D 68 F0 FF FF 51 8B 95\r\n00 EA FF FF 52 }\r\n       $s1 = { 43 72 79 70 74 6F 50 72 6F 2D 58 63 68 42 }\r\n       $s2 = \"-----BEGIN RSA PUBLIC KEY-----\"\r\n       $s3 = \".CRYPT\"\r\n   condition:\r\n       all of them\r\n}\r\nssdeep Matches\r\nNo matches found.\r\nPE Metadata\r\nCompile Date 2021-03-09 03:08:39-05:00\r\nImport Hash f8b8e20e844ccd50a8eb73c2fca3626d\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n4289116f218aa083456871506085e1be header 1024 2.596118\r\n46c15879afc7b600a23284d8e72f87aa .text 976896 7.069452\r\nd0093b4c33543ebd59b2c22c7e71670f .rdata 265728 6.128934\r\n8883af046ae6ebae63ae3882d79bfc4e .data 25600 4.793715\r\na0bf446401bdd255b7f7cb0215177d73 .rsrc 512 5.108717\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 24 of 26\n\nMD5 Name Raw Size Entropy\r\nbcd8233433c686e481a6c5a4f1f263ac .reloc 51712 5.474063\r\nPackers/Compilers/Cryptors\r\nRelationships\r\n10bce0ff65... Related_To konedieyp[@]airmail.cc\r\n10bce0ff65... Related_To uenwonken[@]memail.com\r\nDescription\r\nThis file is a malicious 32-bit Windows executable. It has been identified as a variant of the DearCry ransomware and is\r\nsimilar in design and functionality to the file 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.\r\nThe hard-coded RSA key contained within this binary is illustrated below.\r\n--Begin RSA public key--\r\nMIIBCAKCAQEA1Qdzdr0sRv1i+hUXF6rzsLYjQ3NRuJO16S4MpmG54q5mX0TxEEh1FmkQwULatEQkDSBC1Qbi6ZNAYhvYGj4K2G2dfIexSXfaz\r\n--End RSA public key--\r\nThis ransomware provides the following ransom note within directories of encrypted files on the target system and shared\r\ndrives:\r\n--Begin ransom note--\r\nYour file has been encrypted!\r\n                        If you want to decrypt, please contact us.\r\n                        konedieyp[@]airmail.cc or uenwonken[@]memail.com\r\n                        And please send me the following hash!\r\n                        2133c369fb115ea61eebd7b62768decf\r\n--End ransom note--\r\nRelationship Summary\r\n2b9838da7e... Related_To konedieyp[@]airmail.cc\r\n2b9838da7e... Related_To uenwonken[@]memail.com\r\nkonedieyp[@]airmail.cc Related_To 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\r\nkonedieyp[@]airmail.cc Related_To fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65\r\nkonedieyp[@]airmail.cc Related_To 027119161d11ba87acc908a1d284b93a6bcafccc012e52ce390ecb9cd745bf27\r\nkonedieyp[@]airmail.cc Related_To e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\r\nkonedieyp[@]airmail.cc Related_To feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\r\nkonedieyp[@]airmail.cc Related_To 10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da\r\nuenwonken[@]memail.com Related_To 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff\r\nuenwonken[@]memail.com Related_To fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65\r\nuenwonken[@]memail.com Related_To 027119161d11ba87acc908a1d284b93a6bcafccc012e52ce390ecb9cd745bf27\r\nuenwonken[@]memail.com Related_To e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6\r\nuenwonken[@]memail.com Related_To feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede\r\nuenwonken[@]memail.com Related_To 10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da\r\nfdec933ca1... Related_To konedieyp[@]airmail.cc\r\nfdec933ca1... Related_To uenwonken[@]memail.com\r\n027119161d... Related_To konedieyp[@]airmail.cc\r\n027119161d... Related_To uenwonken[@]memail.com\r\ne044d9f2d0... Related_To konedieyp[@]airmail.cc\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 25 of 26\n\ne044d9f2d0... Related_To uenwonken[@]memail.com\r\nfeb3e6d30b... Related_To konedieyp[@]airmail.cc\r\nfeb3e6d30b... Related_To uenwonken[@]memail.com\r\n10bce0ff65... Related_To konedieyp[@]airmail.cc\r\n10bce0ff65... Related_To uenwonken[@]memail.com\r\nRecommendations\r\nCISA recommends that users and administrators consider using the following best practices to strengthen the security\r\nposture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators\r\nprior to implementation to avoid unwanted impacts.\r\nMaintain up-to-date antivirus signatures and engines.\r\nKeep operating system patches up-to-date.\r\nDisable File and Printer sharing services. If these services are required, use strong passwords or Active Directory\r\nauthentication.\r\nRestrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local\r\nadministrators group unless required.\r\nEnforce a strong password policy and implement regular password changes.\r\nExercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be\r\nknown.\r\nEnable a personal firewall on agency workstations, configured to deny unsolicited connection requests.\r\nDisable unnecessary services on agency workstations and servers.\r\nScan for and remove suspicious e-mail attachments; ensure the scanned attachment is its \"true file type\" (i.e., the\r\nextension matches the file header).\r\nMonitor users' web browsing habits; restrict access to sites with unfavorable content.\r\nExercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).\r\nScan all software downloaded from the Internet prior to executing.\r\nMaintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).\r\nAdditional information on malware incident prevention and handling can be found in National Institute of Standards and\r\nTechnology (NIST) Special Publication 800-83, \"Guide to Malware Incident Prevention \u0026 Handling for Desktops and\r\nLaptops\".\r\nContact Information\r\nDocument FAQ\r\nWhat is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in\r\na timely manner. In most instances this report will provide initial indicators for computer and network defense. To request\r\nadditional analysis, please contact CISA and provide information regarding the level of desired analysis.\r\nWhat is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware\r\nanalysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide\r\ninformation regarding the level of desired analysis.\r\nCan I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to\r\nthis document should be directed to the CISA at 1-844-Say-CISA or SayCISA@cisa.dhs.gov .\r\nCan I submit malware to CISA? Malware samples can be submitted via three methods:\r\nWeb: https://malware.us-cert.gov\r\nE-Mail: submit@malware.us-cert.gov\r\nFTP: ftp.malware.us-cert.gov (anonymous)\r\nCISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software\r\nvulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.cisa.gov.\r\nSource: https://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b\r\nPage 26 of 26",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b"
	],
	"report_names": [
		"ar21-102b"
	],
	"threat_actors": [],
	"ts_created_at": 1775434902,
	"ts_updated_at": 1775791313,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/6e8b4bee0b5ab86b88fad4e5eeaa3846671f2e27.pdf",
		"text": "https://archive.orkl.eu/6e8b4bee0b5ab86b88fad4e5eeaa3846671f2e27.txt",
		"img": "https://archive.orkl.eu/6e8b4bee0b5ab86b88fad4e5eeaa3846671f2e27.jpg"
	}
}