FlatChestWare .NET Ransomware: Loli PDB, 150$ Bitcoin, AES Rijndael, endyou.xn--6frz82g Emoji Domain C2

Genel Bakis

Bu ornek, PDB yolunda FlatChestWare adi gecen, gelistiricisi Loli olan 937KB'lik .NET fidye yazilimi. Bikini Bottom temasli bu ransomware, AES/Rijndael sifreleme kullanarak dosyalari kilitliyor ve 150$ Bitcoin fidye talep ediyor. C2 olarak emoji domain kullanan nadir malware orneklerindendir: endyou.xn--6frz82g.

Teknik Analiz

Fidye Notu

Your personal files have been encrypted, these files being photos, videos,
downloads, documents, and many other files.

Please do not attempt to remove this program, any attempt to remove it could
cause you to be unable to recover your personal files.

Only our service can decrypt your files, so disable your anti-virus and make
no attempt to tamper with anything we have done.

Well to recover your files you need to send a payment of 150$ via Bitcoin to
the address listed on the previous form. Once you have sent the payment press
the 'Verify Payment' button and we will start decrypting your files
automatically after the payment is confirmed.

Oh and don't feel bad for clicking 'Restart Now' we were already encrypting
your files as soon as the application launched.

C2 ve Odeme Dogrulama

• URL: http://www.endyou.xn--6frz82g/listen/listen.php?line1=
• xn--6frz82g emoji domain (IDN encoded)
• SendPassword, CreatePassword — odeme dogrulama

Sifreleme

• encryptAES, RijndaelManaged, SymmetricAlgorithm — AES sifreleme
• encryptFile — dosya sifreleme
• GetExtension — hedef uzanti belirleme

Gelistirici Izi

• PDB: C:\Users\Loli\Documents\Visual Studio 2015\Projects\FlatChestWare\FlatChestWare\obj\Release\FlatChestWare.pdb
• Gelistirici: Loli
• VS2015 ortaminda gelistirilmis

Teknik Ozellikler

IOC Ozeti

• Domain: endyou.xn--6frz82g (emoji IDN)
• Gelistirici: Loli
• SHA256: f8d907099731ba448fef98c4b100265ac37dc57ff26917ff3699fc0060f91cab