From 30230399564af79823f028186eb3ad7eaa34a11b Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Wed, 6 Dec 2017 12:34:17 +0100 Subject: [PATCH] add StorageCrypt Ransomware --- clusters/ransomware.json | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/clusters/ransomware.json b/clusters/ransomware.json index c0d7179b..30b098d8 100644 --- a/clusters/ransomware.json +++ b/clusters/ransomware.json @@ -8589,6 +8589,22 @@ "(Lucifer) [prepend]" ] } + }, + { + "value": "StorageCrypt", + "description": "Recently BleepingComputer has received a flurry of support requests for a new ransomware being named StorageCrypt that is targeting NAS devices such as the Western Digital My Cloud. Victims have been reporting that their files have been encrypted and a note left with a ransom demand of between .4 and 2 bitcoins to get their files back. User's have also reported that each share on their NAS device contains a Autorun.inf file and a Windows executable named 美女与野兽.exe, which translates to Beauty and the beast. From the samples BleepingComputer has received, this Autorun.inf is an attempt to spread the 美女与野兽.exe file to other computers that open the folders on the NAS devices.", + "meta": { + "refs": [ + "https://www.bleepingcomputer.com/news/security/storagecrypt-ransomware-infecting-nas-devices-using-sambacry/" + ], + "extensions": [ + ".locked" + ], + "ransomnotes": [ + "_READ_ME_FOR_DECRYPT.txt", + "Warning\n\nYour documents, photos,databases,important files have been encrypted by RSA-4096 and AES-256!\nIf you modify any file, it may cause make you cannot decrypt!!!\n\nDon't waste your precious time to try decrypt the files.\nIf there is no key that we provide to you , NO ONE can decrypt your precious files, even Jesus.\n\nHow to decrypt your files ?\n\nYou have to pay for decryption in bitcoin\nTo decrypt your files,please following the steps below\n\n1,Pay 2.0 bitcoin to this address: [bitcoin_address]\n\nPay To : [bitcoin_address]\nAmount : 2.0\n\n2,After you have finished paying,Contact us and Send us your Decrypt-ID via email\n\n3,Once we have confimed your deal,You can use the tool we sent to you to decrypt all your files.\n\nHow to obtain bitcoin ?\n\nThe easiest way to buy bitcoin is LocalBitcoins site.\nYou have to register, click Buy bitcoins and select the seller\nby payment method and price\n\nhttps://localbitcoins.com/buy_bitcoins\n\nhttps://paxful.com/buy-bitcoin\n\nhttp://bitcointalk.org/\n\n If you have any questions please do not hesitate to contact us\n\nContact Email:JeanRenoAParis@protonmail.com\n\nDecrypt-ID:" + ] + } } ], "source": "Various",