ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ

ื ื ื™ื™ึทืข ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื’ืขืจื•ืคืŸ Nemty ืื™ื– ืืจื•ื™ืก ืื•ื™ืฃ ื“ืขืจ ื ืขืฅ, ื•ื•ืึธืก ืื™ื– ืกืึทืคึผืึธื•ื–ืึทื“ืœื™ ื“ืขืจ ืกืึทืงืกืขืกืขืจ ืคื•ืŸ GrandCrab ืึธื“ืขืจ Buran. ื“ื™ ืžืึทืœื•ื•ืึทืจืข ืื™ื– ื“ืขืจ ื”ื•ื™ืคึผื˜ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ื•ื•ืขื‘ื–ื™ื™ื˜ืœ ืื•ืŸ ื”ืื˜ ืึท ื ื•ืžืขืจ ืคื•ืŸ ื˜ืฉื™ืงืึทื•ื•ืข ืคึฟืขื™ึดืงื™ื™ื˜ืŸ. ื“ืขื˜ืึทื™ืœืก ื•ื•ืขื’ืŸ ื•ื•ื™ ื“ืขื ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืึทืจื‘ืขื˜ ื–ืขื ืขืŸ ืื•ื ื˜ืขืจ ื“ื™ ื“ื•ืจื›ืฉื ื™ื˜.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ

ื ื™ื• Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื“ื™ืกืงืึทื•ื•ืขืจื“ ื“ื•ืจืš ื‘ืึทื ื™ืฆืขืจ nao_sec 7 ืกืขืคื˜ืขืžื‘ืขืจ 2019. ื“ื™ ืžืึทืœื•ื•ืึทืจืข ืื™ื– ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ื“ื•ืจืš ืึท ื•ื•ืขื‘ื–ื™ื™ื˜ืœ ื“ื™ืกื’ื™ื™ื–ื“ ื•ื•ื™ PayPal, ืขืก ืื™ื– ืื•ื™ืš ืžืขื’ืœืขืš ืคึฟืึทืจ ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืฆื• ื“ื•ืจื›ื ืขืžืขืŸ ืึท ืงืึธืžืคึผื™ื•ื˜ืขืจ ื“ื•ืจืš ื“ื™ RIG ืขืงืกืคึผืœื•ื™ื˜ ืงื™ื˜. ื“ื™ ืื˜ืืงืขืจ ื”ืื‘ืŸ ื’ืขื ื•ืฆื˜ ืกืืฆื™ืืœืข ืื™ื ื–ืฉืขื ื™ืจื™ืข ืžืขื˜ืื“ืŸ ืฆื• ืฆื•ื•ื™ื ื’ืขืŸ ื“ืขื ื‘ืื ื•ืฆืขืจ ืฆื• ืœื•ื™ืคืŸ ื“ื™ cashback.exe ื˜ืขืงืข, ื•ื•ืืก ืขืจ ื”ืื˜ ืœื›ืื•ืจื” ื‘ืืงื•ืžืขืŸ ืคื•ืŸ ื“ื™ ืคื™ื™ืคืืœ ื•ื•ืขื‘ื–ื™ื™ื˜, ืขืก ืื™ื– ืื•ื™ืš ื ื™ื™ื’ืขืจื™ื’ ืื– Nemty ื”ืื˜ ืกืคึผืขืฆื™ืคื™ืฆื™ืจื˜ ื“ืขื ืื•ืžืจืขื›ื˜ ืคืืจื˜ ืคืืจ ื“ื™ ืœืืงืืœืข ืคืจืืงืกื™ ืกืขืจื•ื•ื™ืก Tor, ื•ื•ืืก ืคืืจืžื™ื™ื“ื˜ ื“ื™ ืžืึทืœื•ื•ืึทืจืข ืคื•ืŸ โ€‹โ€‹ืฉื™ืงืŸ. ื“ืึทื˜ืŸ ืฆื• ื“ื™ ืกืขืจื•ื•ืขืจ. ื“ืขืจื™ื‘ืขืจ, ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ื•ื•ืขื˜ ื”ืึธื‘ืŸ ืฆื• ืฆื•ืคึฟืขืœื™ืงืขืจ ื™ื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืขืก ืฆื• ื“ื™ Tor ื ืขืฅ ืื•ื™ื‘ ืขืจ ื‘ื“ืขื” ืฆื• ืฆืึธืœืŸ ื“ื™ ื•ื™ืกืœื™ื™ื–ื’ืขืœื˜ ืื•ืŸ ื•ื•ืึทืจื˜ืŸ ืคึฟืึทืจ ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ืคื•ืŸ ื“ื™ ืึทื˜ืึทืงืขืจื–.

ืขื˜ืœืขื›ืข ื˜ืฉื™ืงืึทื•ื•ืข Facts ื•ื•ืขื’ืŸ Nemty ืคึฟืึธืจืฉืœืึธื’ืŸ ืึทื– ืขืก ืื™ื– ื“ืขื•ื•ืขืœืึธืคึผืขื“ ื“ื•ืจืš ื“ื™ ื–ืขืœื‘ืข ืžืขื ื˜ืฉืŸ ืึธื“ืขืจ ื“ื•ืจืš ืกื™ื™ื‘ืขืจ ืงืจื™ืžื™ื ืึทืœืก ืคึฟืึทืจื‘ื•ื ื“ืŸ ืžื™ื˜ Buran ืื•ืŸ GrandCrab.

  • ื•ื•ื™ GandCrab, Nemty ื”ืื˜ ืึท ื™ืกื˜ืขืจ ื™ื™ - ืึท ืœื™ื ืง ืฆื• ืึท ืคืึธื˜ืึธ ืคื•ืŸ ืจื•ืกื™ืฉ ืคืจืขื–ื™ื“ืขื ื˜ ื•ื•ืœืื“ื™ืžื™ืจ ืคึผื•ื˜ื™ืŸ ืžื™ื˜ ืึท ื’ืจืึธื‘ ื•ื•ื™ืฅ. ื“ื™ ืœืขื’ืึทื˜ GandCrab ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื”ืื˜ ืึท ื‘ื™ืœื“ ืžื™ื˜ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ื˜ืขืงืกื˜.
  • ื“ื™ ืฉืคึผืจืึทืšึพืึทืจื˜ืึทืคืึทืงื˜ืŸ ืคึฟื•ืŸ ื‘ื™ื™ื“ืข ืคึผืจืึธื’ืจืึทืžืขืŸ ื•ื•ืฒึทื–ืŸ ืื•ื™ืฃ ื“ื™ ื–ืขืœื‘ืข ืจื•ืกื™ืฉึพืจืขื“ื ื“ื™ืงืข ืžื—ื‘ืจื™ื.
  • ื“ืึธืก ืื™ื– ื“ืขืจ ืขืจืฉื˜ืขืจ ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืฆื• ื ื•ืฆืŸ ืึท 8092-ื‘ื™ืกืœ RSA ืฉืœื™ืกืœ. ื›ืึธื˜ืฉ ืขืก ืื™ื– ืงื™ื™ืŸ ืคื•ื ื˜ ืื™ืŸ ื“ืขื: ืึท 1024-ื‘ื™ืกืœ ืฉืœื™ืกืœ ืื™ื– ื’ืึทื ืฅ ื’ืขื ื•ื’ ืฆื• ื‘ืึทืฉื™ืฆืŸ ืงืขื’ืŸ ื›ืึทืงื™ื ื’.
  • ื•ื•ื™ ื‘ื•ืจืึทืŸ, ื“ื™ ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืื™ื– ื’ืขืฉืจื™ื‘ืŸ ืื™ืŸ ืึธื‘ื“ื–ืฉืขืงื˜ ืคึผืึทืกืงืึทืœ ืื•ืŸ ืงืึทืžืคึผื™ื™ืœื“ ืื™ืŸ ื‘ืึธืจืœืึทื ื“ ื“ืขืœืคื™.

ืกื˜ืึทื˜ื™ืง ืึทื ืึทืœื™ืกื™ืก

ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ื‘ื™ื™ื–ืข ืงืึธื“ ืึทืงืขืจื– ืื™ืŸ ืคื™ืจ ืกื˜ืึทื’ืขืก. ื“ืขืจ ืขืจืฉื˜ืขืจ ืฉืจื™ื˜ ืื™ื– ืฆื• ืœื•ื™ืคืŸ cashback.exe, ืึท PE32 ืขืงืกืขืงื•ื˜ืึทื‘ืœืข ื˜ืขืงืข ืื•ื ื˜ืขืจ MS Windows ืžื™ื˜ ืึท ื’ืจื™ื™ืก ืคื•ืŸ 1198936 ื‘ื™ื˜ืขืก. ื–ื™ื™ืŸ ืงืึธื“ ืื™ื– ื’ืขื•ื•ืขืŸ ื’ืขืฉืจื™ื‘ืŸ ืื™ืŸ ื•ื•ื™ืกื•ืึทืœ C ++ ืื•ืŸ ืงืึทืžืคึผื™ื™ืœื“ ืื•ื™ืฃ ืืงื˜ืื‘ืขืจ 14, 2013. ืขืก ื›ึผื•ืœืœ ืึทืŸ ืึทืจืงื™ื™ื•ื• ื•ื•ืึธืก ืื™ื– ืื•ื™ื˜ืึธืžืึทื˜ื™ืฉ ืึทื ืคึผืึทืงื˜ ื•ื•ืขืŸ ืื™ืจ ืœื•ื™ืคืŸ cashback.exe. ื“ื™ ื•ื•ื™ื™ื›ื•ื•ืืจื’ ื ื™ืฆื˜ ื“ื™ Cabinet.dll ื‘ื™ื‘ืœื™ืึธื˜ืขืง ืื•ืŸ ื–ื™ื™ึทืŸ ืคืึทื ื’ืงืฉืึทื ื– FDICreate(), FDIDestroy() ืื•ืŸ ืื ื“ืขืจืข ืฆื• ืงืจื™ื’ืŸ ื˜ืขืงืขืก ืคึฟื•ืŸ ื“ื™ .ืงืึทื‘ ืึทืจืงื™ื™ื•ื•.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
SHA-256: A127323192ABED93AED53648D03CA84DE3B5B006B641033EB46A520B7A3C16FC

ื ืึธืš ืึทื ืคึผืึทืงื™ื ื’ ื“ื™ ืึทืจืงื™ื™ื•ื•, ื“ืจื™ื™ ื˜ืขืงืขืก ื•ื•ืขื˜ ื“ืขืจืฉื™ื™ึทื ืขืŸ.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ืขืจื ืึธืš, temp.exe ืื™ื– ืœืึธื ื˜ืฉื˜, ืึท PE32 ืขืงืกืขืงื•ื˜ืึทื‘ืœืข ื˜ืขืงืข ืื•ื ื˜ืขืจ MS Windows ืžื™ื˜ ืึท ื’ืจื™ื™ืก ืคื•ืŸ 307200 ื‘ื™ื˜ืขืก. ื“ืขืจ ืงืึธื“ ืื™ื– ื’ืขืฉืจื™ื‘ืŸ ืื™ืŸ ื•ื•ื™ืกื•ืึทืœ C ++ ืื•ืŸ ืคึผืึทืงื™ื“ื–ืฉื“ ืžื™ื˜ MPRESS ืคึผืึทืงืขืจ, ืึท ืคึผืึทืงืขืจ ืขื ืœืขืš ืฆื• UPX.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
SHA-256: EBDBA4B1D1DE65A1C6B14012B674E7FA7F8C5F5A8A5A2A9C3C338F02DD726AAD

ื“ืขืจ ื•ื•ื™ื™ึทื˜ืขืจ ืฉืจื™ื˜ ืื™ื– ironman.exe. ืึทืžืึธืœ ืœืึธื ื˜ืฉื˜, temp.exe ื“ืขืงืจื™ืคึผื˜ ื“ื™ ืขืžื‘ืขื“ื™ื“ ื“ืึทื˜ืŸ ืื™ืŸ ื˜ืขืžืคึผ ืื•ืŸ ืจื™ื ื™ื™ืžื– ืขืก ืฆื• ironman.exe, ืึท 32 ื‘ื™ื™ื˜ PE544768 ืขืงืกืขืงื•ื˜ืึทื‘ืœืข ื˜ืขืงืข. ื“ืขืจ ืงืึธื“ ืื™ื– ืงืึทืžืคึผื™ื™ืœื“ ืื™ืŸ ื‘ืึธืจืœืึทื ื“ ื“ืขืœืคื™.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
SHA-256: 2C41B93ADD9AC5080A12BF93966470F8AB3BDE003001492A10F63758867F2A88

ื“ื™ ืœืขืฆื˜ืข ืฉืจื™ื˜ ืื™ื– ืฆื• ืจื™ืกื˜ืึทืจื˜ ื“ื™ ironman.exe ื˜ืขืงืข. ืื™ืŸ ืจื•ื ื˜ื™ืžืข, ืขืก ื˜ืจืึทื ืกืคืึธืจืžื– ื–ื™ื™ืŸ ืงืึธื“ ืื•ืŸ ืœื•ื™ืคื˜ ื–ื™ืš ืคึฟื•ืŸ ื–ื›ึผืจื•ืŸ. ื“ื™ ื•ื•ืขืจืกื™ืข ืคื•ืŸ โ€‹โ€‹ironman.exe ืื™ื– ื‘ื™ื™ื–ืข ืื•ืŸ ืื™ื– ืคืึทืจืึทื ื˜ื•ื•ืึธืจื˜ืœืขืš ืคึฟืึทืจ ืขื ืงืจื™ืคึผืฉืึทืŸ.

ื‘ืึทืคืึทืœืŸ ื•ื•ืขืงื˜ืึธืจ

ื“ืขืจื•ื•ื™ื™ึทืœ, ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืื™ื– ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ื“ื•ืจืš ื“ื™ ื•ื•ืขื‘ื–ื™ื™ื˜ืœ pp-back.info.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ

ื“ื™ ื’ืึทื ืฅ ืงื™ื™ื˜ ืคื•ืŸ ื™ื ืคืขืงืฆื™ืข ืงืขื ืขืŸ ื–ื™ื™ืŸ ื•ื•ื™ื•ื“ ืื™ืŸ app.any.run ื–ืึทืžื“ืงืึทืกื˜ืŸ.

ื™ื ืกื˜ืึทืœื™ืจื•ื ื’

Cashback.exe - ื“ืขืจ ืึธื ื”ื™ื™ื‘ ืคื•ืŸ ื“ื™ ื‘ืึทืคืึทืœืŸ. ื•ื•ื™ ืฉื•ื™ืŸ ื“ืขืจืžืื ื˜, ืงืึทืฉื‘ืึทืงืง.ืขืงืกืข ืึทื ืคึผืึทืงืก ื“ื™ .ืงืึทื‘ ื˜ืขืงืข ืขืก ื›ึผื•ืœืœ. ื“ืขืจื ืึธืš ืงืจื™ื™ื™ืฅ ืึท ื˜ืขืงืข TMP4351$.TMP ืคื•ืŸ ื“ื™ ืคืึธืจืขื %TEMP%IXxxx.TMP, ื•ื•ื• ืงืกืงืกืงืก ืื™ื– ืึท ื ื•ืžืขืจ ืคื•ืŸ 001 ืฆื• 999.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ืขืจื ืึธืš, ืึท ืจืขื’ื™ืกื˜ืจื™ ืฉืœื™ืกืœ ืื™ื– ืื™ื ืกื˜ืึทืœื™ืจืŸ, ื•ื•ืึธืก ืงื•ืงื˜ ื•ื•ื™ ื“ืึธืก:

[HKLMSOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionRunOncewextract_cleanup0]
"rundll32.exe" "C: Windowssystem32advpack.dll, DelNodeRunDLL32 "C:UsersMALWAR~1AppDataLocalTempIXPxxx.TMP""

ืขืก ืื™ื– ื’ืขื ื™ืฆื˜ ืฆื• ื•ื™ืกืžืขืงืŸ ืึทื ืคึผืึทืงื˜ ื˜ืขืงืขืก. ืฆื•ื ืกื•ืฃ, cashback.exe ืกื˜ืึทืจืฅ ื“ื™ temp.exe ืคึผืจืึธืฆืขืก.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
Temp.exe ืื™ื– ื“ื™ ืจื’ืข ื‘ื™ื ืข ืื™ืŸ ื“ื™ ื™ื ืคืขืงืฆื™ืข ืงื™ื™ื˜

ื“ืึธืก ืื™ื– ื“ืขืจ ืคึผืจืึธืฆืขืก ืœืึธื ื˜ืฉื˜ ื“ื•ืจืš ื“ื™ cashback.exe ื˜ืขืงืข, ื“ื™ ืจื’ืข ืฉืจื™ื˜ ืคื•ืŸ ื“ื™ ื•ื•ื™ืจื•ืก ื“ื•ืจื›ืคื™ืจื•ื ื’. ืขืก ืคืจื•ื•ื•ื˜ ืฆื• ืึธืคึผืœืึธื“ื™ืจืŸ AutoHotKey, ืึท ื’ืขืฆื™ื™ึทื’ ืคึฟืึทืจ ืคืœื™ืกื ื“ื™ืง ืกืงืจื™ืคึผืก ืื•ื™ืฃ ื•ื•ื™ื ื“ืึธื•ื–, ืื•ืŸ ืœื•ื™ืคืŸ ื“ื™ WindowSpy.ahk ืฉืจื™ืคื˜ ืœื™ื’ืŸ ืื™ืŸ ื“ื™ ืจืขืกื•ืจืกืŸ ืึธืคึผื˜ื™ื™ืœื•ื ื’ ืคื•ืŸ ื“ื™ ืคึผืข ื˜ืขืงืข.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ื™ WindowSpy.ahk ืฉืจื™ืคื˜ ื“ืขืงืจื™ืคึผื˜ ื“ื™ ื˜ืขืžืคึผ ื˜ืขืงืข ืื™ืŸ ironman.exe ืžื™ื˜ ื“ื™ RC4 ืึทืœื’ืขืจื™ื“ืึทื ืื•ืŸ ื“ื™ ืคึผืึทืจืึธืœ IwantAcake. ื“ืขืจ ืฉืœื™ืกืœ ืคึฟื•ืŸ ื“ื™ ืคึผืึทืจืึธืœ ืื™ื– ื‘ืืงื•ืžืขืŸ ืžื™ื˜ ื“ื™ MD5 ื›ืึทืฉื™ื ื’ ืึทืœื’ืขืจื™ื“ืึทื.

temp.exe ืจื•ืคื˜ ื“ื™ ironman.exe ืคึผืจืึธืฆืขืก.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
Ironman.exe - ื“ืจื™ื˜ ืฉืจื™ื˜

Ironman.exe ืœื™ื™ืขื ื˜ ื“ื™ ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ iron.bmp ื˜ืขืงืข ืื•ืŸ ืงืจื™ื™ื™ืฅ ืึทืŸ iron.txt ื˜ืขืงืข ืžื™ื˜ ืึท ืงืจื™ืคึผื˜ืึธืงืงืขืจ ื•ื•ืึธืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ืœืึธื ื˜ืฉื˜ ื•ื•ื™ื™ึทื˜ืขืจ.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื ืึธืš ื“ืขื, ื“ืขืจ ื•ื•ื™ืจื•ืก ืœืึธื•ื“ื– iron.txt ืื™ืŸ ื–ื›ึผืจื•ืŸ ืื•ืŸ ืจื™ืกื˜ืึทืจื˜ ืขืก ื•ื•ื™ ironman.exe. ื ืึธืš ื“ืขื, iron.txt ืื™ื– ืื•ื™ืกื’ืขืžืขืงื˜.

ironman.exe ืื™ื– ื“ืขืจ ื”ื•ื™ืคึผื˜ ื˜ื™ื™ืœ ืคื•ืŸ ื“ื™ NEMTY ืจืึทื ืกืึธืžื•ื•ืึทืจืข, ื•ื•ืึธืก ื™ื ืงืจื™ืคึผื˜ ื˜ืขืงืขืก ืื•ื™ืฃ ื“ื™ ืึทืคืขืงื˜ืึทื“ ืงืึธืžืคึผื™ื•ื˜ืขืจ. ืžืึทืœื•ื•ืึทืจืข ืงืจื™ื™ื™ืฅ ืึท ืžื•ื˜ืขืงืก ื’ืขืจื•ืคืŸ ื”ืึทืก.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ืขืจ ืขืจืฉื˜ืขืจ ื–ืึทืš ืขืก ืื™ื– ืฆื• ื‘ืึทืฉืœื™ืกืŸ ื“ื™ ื“ื–ืฉื™ืึทื’ืจืึทืคื™ืง ืึธืจื˜ ืคื•ืŸ ื“ื™ ืงืึธืžืคึผื™ื•ื˜ืขืจ. Nemty ืขืคึฟื ื˜ ื“ืขื ื‘ืœืขื˜ืขืจืขืจ ืื•ืŸ ื’ืขืคึฟื™ื ืขืŸ ื“ื™ IP ืื•ื™ืฃ http://api.ipify.org. ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ api.db-ip.com/v2/free[IP]/countryName ื“ื™ ืžื“ื™ื ื” ืื™ื– ื‘ืืฉืœืืกืŸ ืคื•ืŸ ื“ื™ ื‘ืืงื•ืžืขืŸ IP, ืื•ืŸ ืื•ื™ื‘ ื“ืขืจ ืงืึธืžืคึผื™ื•ื˜ืขืจ ืื™ื– ืœื™ื’ืŸ ืื™ืŸ ืื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ ืžืงื•ืžื•ืช ืœื™ืกื˜ืขื“ ืื•ื ื˜ืŸ, ื“ื™ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ื“ื™ ืžืึทืœื•ื•ืึทืจืข ืงืึธื“ ืกื˜ืึทืคึผืก:

  • ืจื•ืกืœืึทื ื“
  • ื‘ื™ืขืœืึธืจื•ืกืกื™ืึท
  • ืื•ืงืจื™ื™ื ื
  • ืงืึทื–ืึทื›ืกื˜ืึทืŸ
  • ื˜ืึทื“ื–ืฉื™ืงื™ืกื˜ืึทืŸ

ืจื•ื‘ึฟ ืžืกืชึผืžื, ื“ืขื•ื•ืขืœืึธืคึผืขืจืก ื˜ืึธืŸ ื ื™ืฉื˜ ื•ื•ืขืœืŸ ืฆื• ืฆื•ืฆื™ืขืŸ ื“ื™ ื•ืคืžืขืจืงื–ืึทืžืงื™ื™ื˜ ืคื•ืŸ ื’ืขื–ืขืฅ ืขื ืคืึธืจืกืžืึทื ื˜ ื™ื™ื“ื–ืฉืึทื ืกื™ื– ืื™ืŸ ื–ื™ื™ืขืจ ืœืขื ื“ืขืจ ืคื•ืŸ ื•ื•ื•ื™ื ืึธืจื˜, ืื•ืŸ ื“ืขืจื™ื‘ืขืจ ื˜ืึธืŸ ื ื™ื˜ ื™ื ืงืจื™ืคึผื˜ ื˜ืขืงืขืก ืื™ืŸ ื–ื™ื™ืขืจ "ื”ื™ื™ื" ื“ื–ืฉื•ืจื™ืกื“ื™ืงืฉืึทื ื–.

ืื•ื™ื‘ ื“ื™ IP ืึทื“ืจืขืก ืคื•ืŸ ื“ื™ ืงืึธืจื‘ืŸ ื’ืขื”ืขืจื˜ ื ื™ืฉื˜ ืฆื• ื“ืขืจ ืจืฉื™ืžื” ืื•ื™ื‘ืŸ, ื“ืขืจ ื•ื•ื™ืจื•ืก ื™ื ืงืจื™ืคึผื˜ ื“ื™ ื‘ืึทื ื™ืฆืขืจ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ

ืฆื• ืคืึทืจืžื™ื™ึทื“ืŸ ื˜ืขืงืข ืึธืคึผื–ื•ืš, ื–ื™ื™ืขืจ ืฉืึธื˜ืŸ ืงืืคื™ืขืก ื–ืขื ืขืŸ ืื•ื™ืกื’ืขืžืขืงื˜:

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ืขืจื ืึธืš, ืขืก ืงืจื™ื™ื™ืฅ ืึท ืจืฉื™ืžื” ืคื•ืŸ ื˜ืขืงืขืก ืื•ืŸ ืคืึธืœื“ืขืจืก ื•ื•ืึธืก ื•ื•ืขื˜ ื ื™ืฉื˜ ื–ื™ื™ืŸ ื™ื ืงืจื™ืคึผื˜ื™ื“, ื•ื•ื™ ื’ืขื–ื•ื ื˜ ื•ื•ื™ ืึท ืจืฉื™ืžื” ืคื•ืŸ ื˜ืขืงืข ื™ืงืกื˜ืขื ืฉืึทื ื–.

  • ืคึฟืขื ืฆื˜ืขืจ
  • $ืจืขืกื™ืงืœืข.ื‘ื™ืŸ
  • rsa
  • NTDETECT.COM
  • ื ื˜ืœื“ืจ
  • MSDOS.SYS
  • IO.SYS
  • boot.ini AUTOEXEC.BAT ntuser.dat
  • desktop.ini
  • SYS CONFIG.
  • BOOTSECT.BAK
  • bootmgr
  • ืคึผืจืึธื’ืจืึทื ื“ืึทื˜ืึท
  • ืึทืคึผืคึผื“ืึทื˜ืึท
  • ืึธืกืึธืคื˜
  • ืคึผืจืึธืกื˜ ืคื™ืœืขืก 

log LOG CAB cab CMD cmd COM com cpl
CPL exe EXE ini INI dll DDL lnk LNK url
URL ttf TTF DECRYPT.txt NEMTY

ืึทื‘ืคืึทืกืงื™ื™ืฉืึทืŸ

ืฆื• ื‘ืึทื”ืึทืœื˜ืŸ URL ืก ืื•ืŸ ืขืžื‘ืขื“ื™ื“ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื“ืึทื˜ืŸ, Nemty ื ื™ืฆื˜ ืึท Base64 ืื•ืŸ RC4 ืงืึธื“ื™ืจื•ื ื’ ืึทืœื’ืขืจื™ื“ืึทื ืžื™ื˜ ื“ื™ Fuckav ืงื™ื•ื•ืขืจื“.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ื™ ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ืคึผืจืึธืฆืขืก ื ื™ืฆืŸ CryptStringToBinary ืื™ื– ื•ื•ื™ ื’ื™ื™ื˜

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ

ืขื ืงืจื™ืคึผืฉืึทืŸ

Nemty ื ื™ืฆื˜ ื“ืจื™ื™-ืฉื™ื›ื˜ืข ืขื ืงืจื™ืคึผืฉืึทืŸ:

  • AES-128-CBC ืคึฟืึทืจ ื˜ืขืงืขืก. ื“ื™ 128-ื‘ื™ืกืœ AES ืฉืœื™ืกืœ ืื™ื– ืจืึทื ื“ืึทืžืœื™ ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ืื•ืŸ ืื™ื– ื’ืขื ื™ืฆื˜ ื“ื™ ื–ืขืœื‘ืข ืคึฟืึทืจ ืึทืœืข ื˜ืขืงืขืก. ืขืก ืื™ื– ืกื˜ืึธืจื“ ืื™ืŸ ืึท ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข ืื•ื™ืฃ ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ 'ืก ืงืึธืžืคึผื™ื•ื˜ืขืจ. ื“ื™ IV ืื™ื– ืจืึทื ื“ืึทืžืœื™ ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ืคึฟืึทืจ ื™ืขื“ืขืจ ื˜ืขืงืข ืื•ืŸ ืกื˜ืึธืจื“ ืื™ืŸ ืึท ื™ื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืข.
  • RSA-2048 ืคึฟืึทืจ ื˜ืขืงืข ืขื ืงืจื™ืคึผืฉืึทืŸ IV. ื ืฉืœื™ืกืœ ืคึผืึธืจ ืคึฟืึทืจ ื“ื™ ืกืขืกื™ืข ืื™ื– ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“. ื“ืขืจ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ ืคึฟืึทืจ ื“ื™ ืกืขืกื™ืข ืื™ื– ืกื˜ืึธืจื“ ืื™ืŸ ืึท ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข ืื•ื™ืฃ ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ 'ืก ืงืึธืžืคึผื™ื•ื˜ืขืจ.
  • RSA-8192. ื“ืขืจ ื‘ืขืœ ืฆื™ื‘ื•ืจ ืฉืœื™ืกืœ ืื™ื– ื’ืขื‘ื•ื™ื˜ ืื™ืŸ ื“ืขื ืคึผืจืึธื’ืจืึทื ืื•ืŸ ืื™ื– ื’ืขื ื™ืฆื˜ ืฆื• ืขื ืงืจื™ืคึผื˜ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข, ื•ื•ืึธืก ืกื˜ืึธืจื– ื“ื™ AES ืฉืœื™ืกืœ ืื•ืŸ ืกื•ื“ ืฉืœื™ืกืœ ืคึฟืึทืจ ื“ื™ RSA-2048 ืกืขืกื™ืข.
  • Nemty ืขืจืฉื˜ืขืจ ื“ื–ืฉืขื ืขืจื™ื™ืฅ 32 ื‘ื™ื˜ืขืก ืคื•ืŸ ื˜ืจืึทืค - ื“ืึทื˜ืŸ. ื“ืขืจ ืขืจืฉื˜ืขืจ 16 ื‘ื™ื˜ืขืก ื–ืขื ืขืŸ ื’ืขื ื™ืฆื˜ ื•ื•ื™ ื“ื™ AES-128-CBC ืฉืœื™ืกืœ.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ื™ ืฆื•ื•ื™ื™ื˜ืข ืขื ืงืจื™ืคึผืฉืึทืŸ ืึทืœื’ืขืจื™ื“ืึทื ืื™ื– RSA-2048. ื“ืขืจ ืฉืœื™ืกืœ ืคึผืึธืจ ืื™ื– ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ื“ื•ืจืš ื“ื™ CryptGenKey () ืคึฟื•ื ืงืฆื™ืข ืื•ืŸ ื™ืžืคึผืึธืจื˜ื™ื“ ื“ื•ืจืš ื“ื™ CryptImportKey () ืคึฟื•ื ืงืฆื™ืข.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ืึทืžืึธืœ ื“ื™ ืฉืœื™ืกืœ ืคึผืึธืจ ืคึฟืึทืจ ื“ื™ ืกืขืกื™ืข ืื™ื– ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“, ื“ืขืจ ืฆื™ื‘ื•ืจ ืฉืœื™ืกืœ ืื™ื– ื™ืžืคึผืึธืจื˜ื™ื“ ืื™ืŸ ื“ื™ MS Cryptographic Service Provider.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ืึท ื‘ื™ื™ืฉืคึผื™ืœ ืคื•ืŸ ืึท ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ืฆื™ื‘ื•ืจ ืฉืœื™ืกืœ ืคึฟืึทืจ ืึท ืกืขืกื™ืข:

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ืขืจื ืึธืš, ื“ื™ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ ืื™ื– ื™ืžืคึผืึธืจื˜ื™ื“ ืื™ืŸ ื“ื™ CSP.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ืึท ื‘ื™ื™ืฉืคึผื™ืœ ืคื•ืŸ ืึท ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ ืคึฟืึทืจ ืึท ืกืขืกื™ืข:

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ืื•ืŸ ืœืขืฆื˜ ืงื•ืžื˜ RSA-8192. ื“ืขืจ ื”ื•ื™ืคึผื˜ ืฆื™ื‘ื•ืจ ืฉืœื™ืกืœ ืื™ื– ืกื˜ืึธืจื“ ืื™ืŸ ื™ื ืงืจื™ืคึผื˜ื™ื“ ืคืึธืจืขื (Base64 + RC4) ืื™ืŸ ื“ื™ .ื“ืึทื˜ืึท ืึธืคึผื˜ื™ื™ืœื•ื ื’ ืคื•ืŸ ื“ื™ ืคึผืข ื˜ืขืงืข.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ืขืจ RSA-8192 ืฉืœื™ืกืœ ื ืึธืš Base64 ื“ื™ืงืึธื•ื“ื™ื ื’ ืื•ืŸ RC4 ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ืžื™ื˜ ื“ื™ Fuckav ืคึผืึทืจืึธืœ ืงื•ืงื˜ ื•ื•ื™ ื“ืึธืก.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื•ื•ื™ ืึท ืจืขื–ื•ืœื˜ืึทื˜, ื“ื™ ื’ืื ืฆืข ืขื ืงืจื™ืคึผืฉืึทืŸ ืคึผืจืึธืฆืขืก ืงื•ืงื˜ ื•ื•ื™ ื“ืึธืก:

  • ื“ื–ืฉืขื ืขืจื™ื™ื˜ ืึท 128-ื‘ื™ืกืœ AES ืฉืœื™ืกืœ ื•ื•ืึธืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขื ื™ืฆื˜ ืฆื• ืขื ืงืจื™ืคึผื˜ ืึทืœืข ื˜ืขืงืขืก.
  • ืฉืึทืคึฟืŸ ืึท IV ืคึฟืึทืจ ื™ืขื“ืขืจ ื˜ืขืงืข.
  • ืฉืึทืคึฟืŸ ืึท ืฉืœื™ืกืœ ืคึผืึธืจ ืคึฟืึทืจ ืึท RSA-2048 ืกืขืกื™ืข.
  • ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ืคื•ืŸ ืึท ื™ื’ื–ื™ืกื˜ื™ื ื’ RSA-8192 ืฉืœื™ืกืœ ื ื™ืฆืŸ base64 ืื•ืŸ RC4.
  • ืขื ืงืจื™ืคึผื˜ ื˜ืขืงืข ืื™ื ื”ืึทืœื˜ ืžื™ื˜ ื“ื™ AES-128-CBC ืึทืœื’ืขืจื™ื“ืึทื ืคึฟื•ืŸ ื“ืขืจ ืขืจืฉื˜ืขืจ ืฉืจื™ื˜.
  • IV ืขื ืงืจื™ืคึผืฉืึทืŸ ื ื™ืฆืŸ RSA-2048 ืฆื™ื‘ื•ืจ ืฉืœื™ืกืœ ืื•ืŸ Base64 ืงืึธื“ื™ืจื•ื ื’.
  • ืึทื“ื™ื ื’ ืึท ื™ื ืงืจื™ืคึผื˜ื™ื“ IV ืฆื• ื“ื™ ืกื•ืฃ ืคื•ืŸ ื™ืขื“ืขืจ ื™ื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืข.
  • ืึทื“ื™ื ื’ ืึท AES ืฉืœื™ืกืœ ืื•ืŸ RSA-2048 ืกืขืกื™ืข ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ ืฆื• ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ.
  • ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื“ืึทื˜ืข ื“ื™ืกืงืจื™ื™ื‘ื“ ืื™ืŸ ืึธืคึผื˜ื™ื™ืœื•ื ื’ ื–ืึทืžืœื•ื ื’ ืคื•ืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ื™ื ืคืขืงื˜ืึทื“ ืงืึธืžืคึผื™ื•ื˜ืขืจ ื–ืขื ืขืŸ ื™ื ืงืจื™ืคึผื˜ื™ื“ ืžื™ื˜ ื“ื™ ื”ื•ื™ืคึผื˜ ืฆื™ื‘ื•ืจ ืฉืœื™ืกืœ RSA-8192.
  • ื“ื™ ืขื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืข ืงื•ืงื˜ ื•ื•ื™ ื“ืึธืก:

ื‘ื™ื™ึทืฉืคึผื™ืœ ืคื•ืŸ ืขื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืขืก:

ืงืึทืœืขืงื˜ื™ื ื’ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ื™ื ืคืขืงื˜ืึทื“ ืงืึธืžืคึผื™ื•ื˜ืขืจ

ื“ื™ ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืงืึทืœืขืงืฅ ืฉืœื™ืกืœืขืŸ ืฆื• ื“ืขืงืจื™ืคึผื˜ ื™ื ืคืขืงื˜ืึทื“ ื˜ืขืงืขืก, ืึทื–ื•ื™ ื“ืขืจ ืึทื˜ืึทืงืขืจ ืงืขื ืขืŸ ืึทืงืฉืœื™ ืžืึทื›ืŸ ืึท ื“ืขืงืจื™ืคึผื˜ืึธืจ. ืื™ืŸ ืึทื“ื™ืฉืึทืŸ, Nemty ืงืึทืœืขืงืฅ ื‘ืึทื ื™ืฆืขืจ ื“ืึทื˜ืŸ ืึทื–ืึท ื•ื•ื™ ื ืืžืขืŸ, ืงืึธืžืคึผื™ื•ื˜ืขืจ ื ืึธืžืขืŸ, ื™ื™ึทื–ื ื•ื•ืึทืจื’ ืคึผืจืึธืคื™ืœ.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ืขืก ืจื•ืคื˜ ื“ื™ GetLogicalDrives(), GetFreeSpace(), GetDriveType() ืคืึทื ื’ืงืฉืึทื ื– ืฆื• ื–ืึทืžืœืขืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ื“ืจื™ื™ื•ื•ื– ืคื•ืŸ ื“ื™ ื™ื ืคืขืงื˜ืึทื“ ืงืึธืžืคึผื™ื•ื˜ืขืจ.

ื“ื™ ื’ืขื–ืืžืœื˜ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืื™ื– ืกื˜ืึธืจื“ ืื™ืŸ ืึท ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข. ื ืึธืš ื“ื™ืงืึธื•ื“ืึทื“ ื“ื™ ืฉื˜ืจื™ืงืœ, ืžื™ืจ ื‘ืึทืงื•ืžืขืŸ ืึท ืจืฉื™ืžื” ืคื•ืŸ ืคึผืึทืจืึทืžืขื˜ืขืจืก ืื™ืŸ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข:

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื‘ื™ื™ึทืฉืคึผื™ืœ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ืคื•ืŸ ืึท ื™ื ืคืขืงื˜ืึทื“ ืงืึธืžืคึผื™ื•ื˜ืขืจ:

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ืžื•ืกื˜ืขืจ ืงืขื ืขืŸ ื–ื™ื™ืŸ ืจืขืคึผืจื™ื–ืขื ื˜ื™ื“ ื•ื•ื™ ื’ื™ื™ื˜:

{"ืึทืœื’ืขืžื™ื™ื ืข": {"IP":"[IP]", "ืœืึทื ื“":"[ืœืึทื ื“]", "ืงืึธืžืคึผื™ื•ื˜ืขืจื ืึทืžืข":"[ืงืึธืžืคึผื™ื•ื˜ืขืจื ืึทืžืข]", "ื‘ืึทื ื™ืฆืขืจื ืึทืžืข":"[ื‘ืึทื ื™ืฆืขืจื ืึทืžืข]", "ืึธืก": "[OS]", "isRU":false, "version":"1.4", "CompID":"{[ืงืึธืžืคึผื™ื“]}", "FileID":"_NEMTY_[FileID]_", "UserID":"[ UserID]", "key":"[key]", "pr_key":"[ืคึผr_key]

Nemty ืกื˜ืึธืจื– ื“ื™ ื’ืขื–ืืžืœื˜ ื“ืึทื˜ืŸ ืื™ืŸ JSON ืคึฟืึธืจืžืึทื˜ ืื™ืŸ ื“ืขืจ ื˜ืขืงืข %USER%/_NEMTY_.nemty. ืคื™ืœืขื™ื“ ืื™ื– 7 ืื•ืชื™ื•ืช ืœืึทื ื’ ืื•ืŸ ืจืึทื ื“ืึทืžืœื™ ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ: _NEMTY_tgdLYrd_.nemty. ื“ื™ FileID ืื™ื– ืื•ื™ืš ืึทืคึผืคึผืขื ื“ืขื“ ืฆื• ื“ื™ ืกื•ืฃ ืคื•ืŸ ื“ื™ ื™ื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืข.

ื•ื™ืกืœื™ื™ื–ืŸ ืึธื ื–ืึธื’

ื ืึธืš ืขื ืงืจื™ืคึผื˜ื™ื ื’ ื“ื™ ื˜ืขืงืขืก, ื“ื™ ื˜ืขืงืข _NEMTY_[FileID]-DECRYPT.txt ืื™ื– ืืจื•ื™ืก ืื•ื™ืฃ ื“ื™ ื“ืขืกืงื˜ืึทืคึผ ืžื™ื˜ ื“ื™ ืคืืœื’ืขื ื“ืข ืื™ื ื”ืึทืœื˜:

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ืื™ืŸ ื“ื™ ืกื•ืฃ ืคื•ืŸ ื“ืขืจ ื˜ืขืงืข ืขืก ืื™ื– ื™ื ืงืจื™ืคึผื˜ื™ื“ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ื™ื ืคืขืงื˜ืึทื“ ืงืึธืžืคึผื™ื•ื˜ืขืจ.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ

ื ืขืฅ ืงืึธืžื•ื ื™ืงืึทืฆื™ืข

ื“ืขืจ ironman.exe ืคึผืจืึธืฆืขืก ื“ืึทื•ื ืœืึธื•ื“ื– ื“ื™ Tor ื‘ืœืขื˜ืขืจืขืจ ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’ ืคึฟื•ืŸ ื“ื™ ืึทื“ืจืขืก https://dist.torproject.org/torbrowser/8.5.4/tor-win32-0.4.0.5.zip ืื•ืŸ ืคืจื•ื•ื•ื˜ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ืขืก.

Nemty ื“ืขืžืึธืœื˜ ืคืจื•ื•ื•ื˜ ืฆื• ืฉื™ืงืŸ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื“ืึทื˜ืŸ ืฆื• 127.0.0.1:9050, ื•ื•ื• ืขืก ื™ืงืกืคึผืขืงืฅ ืฆื• ื’ืขืคึฟื™ื ืขืŸ ืึท ืืจื‘ืขื˜ืŸ Tor ื‘ืœืขื˜ืขืจืขืจ ืคืจืืงืกื™. ืึธื‘ืขืจ, ื“ื•ืจืš ืคืขืœื™ืงื™ื™ึทื˜, ื“ื™ Tor ืคืจืืงืกื™ ืœื™ืกืึทื ื– ืื•ื™ืฃ ืคึผืึธืจื˜ 9150, ืื•ืŸ ืคึผืึธืจื˜ 9050 ืื™ื– ื’ืขื ื™ืฆื˜ ื“ื•ืจืš ื“ื™ Tor daemon ืื•ื™ืฃ ืœื™ื ื•ืงืก ืึธื“ืขืจ ืขืงืกืคึผืขืจื˜ ื‘ื•ื ื“ืœืข ืื•ื™ืฃ Windows. ืื–ื•ื™, ืงื™ื™ืŸ ื“ืึทื˜ืŸ ื–ืขื ืขืŸ ื’ืขืฉื™ืงื˜ ืฆื• ื“ื™ ืึทื˜ืึทืงืขืจ ืก ืกืขืจื•ื•ืขืจ. ืึทื ืฉื˜ืึธื˜, ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืงืขื ืขืŸ ืืจืืคืงืืคื™ืข ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข ืžืึทื ื™ื•ืึทืœื™ ื“ื•ืจืš ื‘ืื–ื•ื›ืŸ ื“ื™ Tor ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ื“ื™ื ืกื˜ ื“ื•ืจืš ื“ื™ ืœื™ื ืง ืฆื•ื’ืขืฉื˜ืขืœื˜ ืื™ืŸ ื“ื™ ื•ื™ืกืœื™ื™ื–ื’ืขืœื˜ ืึธื ื–ืึธื’.

ืงืึทื ืขืงื˜ื™ื ื’ ืฆื• Tor proxy:

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ

ื”ื˜ื˜ืคึผ ื‘ืึทืงื•ืžืขืŸ ืงืจื™ื™ื™ืฅ ืึท ื‘ืงืฉื” ืฆื• 127.0.0.1:9050/public/gate?data=

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื“ืึธ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ื“ื™ ืขืคืขื ืขืŸ TCP ืคึผืึธืจืฅ ื•ื•ืึธืก ื–ืขื ืขืŸ ื’ืขื ื™ืฆื˜ ื“ื•ืจืš ื“ื™ TORlocal ืคืจืืงืกื™:

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
Nemty ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ื“ื™ื ืกื˜ ืื•ื™ืฃ ื“ื™ Tor ื ืขืฅ:

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ืื™ืจ ืงืขื ืขืŸ ื•ืคึผืœืึธืึทื“ ืึท ื™ื ืงืจื™ืคึผื˜ื™ื“ ืคืึธื˜ืึธ (ื“ื–ืฉืคึผื’, ืคึผื ื’, ื‘ืžืคึผ) ืฆื• ืคึผืจื•ื‘ื™ืจืŸ ื“ื™ ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ื“ื™ื ืกื˜.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ
ื ืึธืš ื“ืขื, ื“ืขืจ ืึทื˜ืึทืงืขืจ ื‘ืขื˜ ืฆื• ื‘ืึทืฆืึธืœืŸ ืึท ื•ื™ืกืœื™ื™ื–ื’ืขืœื˜. ืื™ืŸ ืคืึทืœ ืคื•ืŸ ื ื™ื˜-ืฆืึธืœื•ื ื’ ื“ื™ ืคึผืจื™ื™ึทื– ืื™ื– ื“ืึทื‘ืึทืœื“.

ื˜ืจืขืคืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึฟื•ืŸ ื“ื™ ืฉื•ื•ื™ื ื“ืœ PayPal ืคึผืœืึทืฅ

ืกืึธืฃ

ืื™ืŸ ื“ืขืจ ืžืึธืžืขื ื˜, ืขืก ืื™ื– ื ื™ื˜ ืžืขื’ืœืขืš ืฆื• ื“ืขืงืจื™ืคึผื˜ ื˜ืขืงืขืก ื™ื ืงืจื™ืคึผื˜ื™ื“ ื“ื•ืจืš Nemty ืึธืŸ ืคึผื™ื™ื™ื ื’ ืึท ื•ื™ืกืœื™ื™ื–ื’ืขืœื˜. ื“ื™ ื•ื•ืขืจืกื™ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื”ืื˜ ืคึผืจืึธืกื˜ ืคึฟืขื™ึดืงื™ื™ื˜ืŸ ืžื™ื˜ ื“ื™ Buran ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืื•ืŸ ื“ื™ ืึทื•ื˜ื“ื™ื™ื˜ื™ื“ GandCrab: ื–ืึทืžืœื•ื ื’ ืื™ืŸ Borland Delphi ืื•ืŸ ื‘ื™ืœื“ืขืจ ืžื™ื˜ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ื˜ืขืงืกื˜. ืื™ืŸ ืึทื“ื™ืฉืึทืŸ, ื“ืึธืก ืื™ื– ื“ืขืจ ืขืจืฉื˜ืขืจ ืขื ืงืจื™ืคึผื˜ืขืจ ื•ื•ืึธืก ื ื™ืฆื˜ ืึท 8092-ื‘ื™ืกืœ RSA ืฉืœื™ืกืœ, ื•ื•ืึธืก, ื•ื•ื™ื“ืขืจ, ื˜ื•ื˜ ื ื™ืฉื˜ ืžืึทื›ืŸ ืงื™ื™ืŸ ื–ื™ื ืขืŸ, ื•ื•ื™ื™ึทืœ ืึท 1024-ื‘ื™ืกืœ ืฉืœื™ืกืœ ืื™ื– ื’ืขื ื•ื’ ืคึฟืึทืจ ืฉื•ืฅ. ืฆื•ื ืกื•ืฃ, ืื•ืŸ ื™ื ื˜ืขืจืขืกื˜ื™ื ื’ืœื™, ืขืก ืคืจื•ื•ื•ื˜ ืฆื• ื ื•ืฆืŸ ื“ืขื ืื•ืžืจืขื›ื˜ ืคึผืึธืจื˜ ืคึฟืึทืจ ื“ื™ ื”ื™ื’ืข Tor ืคืจืืงืกื™ ืกืขืจื•ื•ื™ืก.

ืึธื‘ืขืจ, ืกืึทืœื•ืฉืึทื ื– ืึทืงืจืึธื ื™ืก ื‘ืึทืงืงื•ืคึผ ะธ ืึทืงืจืึธื ื™ืก ื˜ืจื• ื‘ื™ืœื“ ืคืึทืจื”ื™ื˜ืŸ ื“ื™ Nemty ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคื•ืŸ โ€‹โ€‹ืจื™ื˜ืฉื™ื ื’ ื‘ืึทื ื™ืฆืขืจ ืคึผืงืก ืื•ืŸ ื“ืึทื˜ืŸ, ืื•ืŸ ืคึผืจืึทื•ื•ื™ื™ื“ืขืจื– ืงืขื ืขืŸ ื‘ืึทืฉื™ืฆืŸ ื–ื™ื™ืขืจ ืงืœื™ื™ืึทื ืฅ ืžื™ื˜ Acronis Backup Cloud. ืคื•ืœ ืกื™ื™ื‘ืขืจ ืฉื•ืฅ ื’ื™ื˜ ื ื™ื˜ ื‘ืœื•ื™ื– ื‘ืึทืงืึทืคึผ, ืึธื‘ืขืจ ืื•ื™ืš ืฉื•ืฅ ื ื™ืฆืŸ ืึทืงืจืึธื ื™ืก ืึทืงื˜ื™ื•ื• ืฉื•ืฅ, ืึท ืกืคึผืขืฆื™ืขืœ ื˜ืขื›ื ืึธืœืึธื’ื™ืข ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ ืงื™ื ืกื˜ืœืขืš ืกื™ื™ื›ืœ ืื•ืŸ ื‘ื™ื›ื™ื™ื•ื•ื™ืขืจืึทืœ ื›ื™ื•ืจื™ืกื˜ื™ืงืก ื•ื•ืึธืก ืึทืœืึทื•ื– ืื™ืจ ืฆื• ื ื•ื˜ืจืึทืœื™ื™ื– ืืคื™ืœื• ื ืึธืš ืื•ืžื‘ืึทืงืึทื ื˜ ืžืึทืœื•ื•ืึทืจืข.

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’