Another Apocalypse Variant Through RDP?

[lecp 0]

Hi, looks like we have had a server compromised through RDP, I don't suppose they left any keys lying around?? Thanks for any help in advance.

 

Cheers.

 

scan_161208-211744.txt

FRST.txt

Addition.txt

DBCE17647B35F3A842D442D8A0FBE538C0.TXT

Encrypted File.zip

Unencrypted Copy.zip

[Kevin Zoll 309]

Hello,

It is highly unlikely that they left any encryption keys behind. Make sure that RDP is configured properly and change all passwords on this server. You can try using our Apocalypse decryption tool https://decrypter.emsisoft.com/apocalypse

Not that Apocalypse implements the Windows CryptoAPI in a flawed manner resulting in a 1-in-3 chance that the files were encrypted using garbage data, making the files undecryptable.

Copy the below code to Notepad; Save As fixlist.txt to your Desktop.

HKLM\...\Policies\Explorer: [ShowSuperHidden] 1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
2016-12-08 15:38 - 2016-12-08 15:38 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\nssE2D4.tmp
2016-12-08 15:38 - 2016-12-08 15:38 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\~nsu.tmp
2016-12-08 15:04 - 2016-12-08 15:04 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\{465DDE98-DC37-419B-A8AE-E5BD95AB3144}
2016-12-08 15:04 - 2007-01-20 06:46 - 00455600 _____ (Macrovision Corporation) C:\Users\Administrator\AppData\Local\Temp\_is90BC.exe
2016-12-08 14:33 - 2016-12-06 10:14 - 00720085 ____N C:\Users\Administrator\AppData\Local\Temp\_iu14D2N.tmp
2016-12-08 12:55 - 2016-12-08 20:53 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\1
2016-12-06 14:43 - 2016-12-06 15:21 - 00228200 _____ (Bitdefender) C:\Users\Administrator\AppData\Local\Temp\pss5006.tmp
2016-12-06 12:16 - 2016-12-06 12:16 - 00016384 _____ C:\Users\Administrator\AppData\Local\Temp\~DF049AB729B4EE748B.TMP
2016-12-06 11:22 - 2016-12-06 11:22 - 00016384 _____ C:\Users\Administrator\AppData\Local\Temp\~DF11C26362DD6CF806.TMP
2016-12-06 11:05 - 2016-12-06 11:05 - 00016384 _____ C:\Users\Administrator\AppData\Local\Temp\~DF2D59C60A31B9EC7C.TMP
2016-12-04 01:21 - 2016-12-04 01:21 - 00001408 _____ C:\DBCE17647B35F3A842D442D8A0FBE538C0.TXT
2016-11-08 15:47 - 2016-12-06 10:03 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\{15A46CFA-BBE3-496D-A375-1AC227583B8C}
2016-11-08 15:47 - 2016-11-08 15:50 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\{3B85F3EE-4B25-4C40-93EA-BF5D5EAF349B}
2016-11-08 15:49 - 2016-06-09 18:09 - 00000000 ____D C:\Users\Administrator\AppData\Local\Temp\{7D198B6F-187F-4FED-B97A-E6214345E416}
2012-05-29 13:50 - 2012-05-29 13:50 - 0001733 _____ () C:\Users\Administrator\AppData\Local\axejejif.dll
2012-05-30 14:03 - 2012-05-30 14:03 - 0001744 _____ () C:\Users\Administrator\AppData\Local\ekitejed.dll
2012-05-30 12:45 - 2012-05-30 12:45 - 0001735 _____ () C:\Users\Administrator\AppData\Local\uzufokeyibewere.dll
MSCONFIG\startupreg: Decryption Instructions => C:\Windows\system32\notepad.exe "C:\DBCE17647B35F3A842D442D8A0FBE538C0.TXT"
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{0A45DB4D-BD0D-11D2-8D14-00104B9E072A}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{0A45DB4D-BD0D-11D2-8D14-00104B9E072A}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E91E27A2-C5AE-11D2-8D1B-00104B9E072A}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{E91E27A2-C5AE-11D2-8D1B-00104B9E072A}" /f

Close Notepad.

NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

If the tool needed a restart please make sure you let the system restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply.

Note: If the tool warns you about an outdated version please download and run the updated version.

[Kevin Zoll 309]

Thread Closed

Reason: Lack of Response

PM either Kevin, Elise, or Arthur to have this thread reopened.

All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE if you don't we are just going to send you back to this thread.