Rewterz Threat Alert – Nlb Ransomware – Active IOCs

Severity

High

Analysis Summary

Nlb Ransomware is a variant of Dharma ransomware, which is a family of malware that has been actively spreading since 2016. Nlb ransomware, like other forms of ransomware, typically uses a combination of techniques to encrypt the files on a computer or network and demand a ransom payment in exchange for the decryption key. The specific methods used by the Nlb variant may vary, but here is an overview of how it could work:

1. Initial Infection: Nlb ransomware typically spreads through phishing emails or by exploiting vulnerabilities in software. Once it infects a computer, it will typically propagate to other computers on the same network.
2. File Encryption: Once the malware has infected a computer or network, it will begin encrypting files using a strong encryption algorithm. This makes the files inaccessible and unreadable.
3. Ransom Note: After the files have been encrypted, the malware will typically display a ransom note with instructions on how to pay the ransom. The note will typically include a deadline for paying the ransom and a specific Bitcoin address to send the payment to.
4. Payment and Decryption: If a victim pays the ransom, the attackers will typically provide a decryption key to unlock the encrypted files. However, there is no guarantee that the decryption key will be provided, and even if it is, it may not work properly, resulting in the loss of important files.

It is important to note that paying the ransom not only encourages further attacks but also is not recommended. Instead, the best way to protect against Nlb ransomware and similar malware is to regularly back up important files, keep software and security patches up to date, and be cautious when clicking on links or opening attachments in emails.

Impact

• Information Theft
• File Encryption

Indicators of Compromise

MD5

• ee524170a7ffc7ad48afc3a1e7377943

SHA-256

• 4c21b335baf9907cfaec588f25354b804b3d59f3882d923fbaf0d929b933ef49

SHA-1

• c9c8725012fbf7e9651b2e1519eaf17e86a65658

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders