Rewterz Threat Alert – AlumniLocker and Humble Ransomware – IoCs

Severity

Medium

Analysis Summary

Two newly discovered forms of ransomware – AlumniLocker and Humble – have been detected.  These ransomware have very different traits and both attempt to extort a bitcoin ransom in different ways. The ransomware is delivered to victims via a malicious PDF attachment claiming to be an invoice that is distributed in phishing emails. The PDF contains a link that will extract a ZIP archive that runs a PowerShell script to drop the payload and execute the ransomware. 
Like an increasing number of ransomware campaigns, the attackers behind AlumniLocker threaten to publish data stolen from the network of their victim if they’re not paid within 48 hours – although given the ransom demand is so large, victims may decide it’s too much to pay. Humble is unusual for ransomware in that it is compiled with an executable wrapper (Bat2Exe) in batch file. What’s also strange is that it uses Discord – a voice, text and video communications service popular among gamers – to send reports back to its author.

Impact

• Data Exfiltration
• Information Disclosure
• Financial Loss
• Confidentiality Breach

Indicators of Compromise

Domain Name

• femto[.]pw
• boot[.]win32[.]killmbr[.]ad
• root[.]win32[.]killmbr[.]ad
• www[.]minpic[.]de

MD5

• c6fde70f07d7879e028290e0d726fd35
• 45af7c4ed9f584df589f34738f74f145
• 1f02cb745dc400e8f29589b5a50e91a8
• a4ab820409b4a2dc28f7c8d431a1f902
• 015bb16ddcbf8a6326ec859020466c05
• 8e5a7171f1be0254dad65bfd78646f34
• eb154d544f8cb7aeac7700100bfe7c1a

SHA-256

• 10c252d04e0eb8a91688919a57f27193f0567cf45c8cafdd27577314bf7db704
• 57fafcf93acfc6c45a05ef60207226e21e83f538f2e6ea8077f67c907cdce729
• 5f42b161717463991122f88dd7dba95a26bdd3d8c9ed21c316ba7a51e7270f66
• 6be8927f5d508259c8100d363b42215d7c90845b1c6716a71414a6abbd0df230
• c1eb88cc7f7b43de1ef71fae416c729483d71fa930314c36dfb03b01b8455d31
• dd10602b2500fac1f816c54d698c55ebe6a9e208b909bdafc074ccdb2d82a725
• dd61a8b804059891d5f25b39c1dcd5e880088e217ba30aa80ba2c9dbd35d060d
• e97c6e05b1a3d287151638ffe86229597b188f9aa6d34db255f08dbc11dbfbd8

SHA1

• 3d0e9b1ccce6ecc7d946cbbb237b89c10dadf225
• 46f65a6742bccca94098c09f27cc983d12c62c26
• 2e8d8629352682d37479c6d0e87b9f8ec1a0819f
• f040239f22c2d4bfa97d53eb4a73e98d0105eb6c
• f0ff1059e64175c8bf3f557cf1b0f49ed105d7d4
• 7a207db4d2a447a3c547fda5f34d3f6efda5dcf9
• 5bc2d79943de6b47768db926704e21e88cb95aa2

URL

• https[:]//femto[.]pw/7unw
• https[:]//femto[.]pw/cyp5
• https[:]//www[.]minpic[.]de/k/bgk5/fsqz7
• https[:]//www[.]minpic[.]de/k/bgk6/17lim/

Remediation

• Block the threat indicators at their respective controls.
• Do not download files attached in untrusted emails.
• Do not open files unintentionally downloaded from untrusted sources.