Rewterz Threat Alert – ProLock Ransomware – IoCs

July 30, 2020

Severity

Medium

Analysis Summary

The Prolock ransomware targets victims with phishing emails, improperly configured Remote Desktop Protocol (RDP) servers, and remote access connections over RDP with stolen user credentials. In some cases, Qakbot was found as one of ProLock’s means of initial access. The earliest detection of ProLock by Sophos was on a customer’s compromised server, most likely through an exploit of a Remote Desktop Protocol connection. The ProLock actors use their access to conduct some network reconnaissance, as well as to potentially steal data before launching their ransomware attack. They then use the stolen or compromised credentials, built-in Windows tools and scripts to propagate the ransomware across the network.

Impact

Unauthorized access
Information theft
Files encryption

Indicators of Compromise

MD5

8217cf04813e077f04c65f9f259e3eba
e3d06bd8724d850884e79801aa2bdb42
3355ace345e98406bdb331ccad568386
81ade22081f8b94567f1717b14b22918
c579341f86f7e962719c7113943bb6e4

SHA-256

18661f8c245d26be1ec4df48a9e186569a77237f424f322f00ef94652b9d5f35
b262b1b82e5db337d367ea1d4119cadb928963896f1aff940be763a00d45f305
dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178
2f0e4b178311a260601e054b0b405999715084227e49ff18a19e1a59f7b2f309
a6ded68af5a6e5cc8c1adee029347ec72da3b10a439d98f79f4b15801abd7af0

SHA1

a037439ad7e79dbf4a20664cf10126c93429e350
0ce3614560e7c1ddbc3b8f56f3e45278de47d3bb
81d5888bb8d43d88315c040be1f51db6bb5cf64c
4f125d890a8f98c9c7069b0bb2b5625c7754fad6
e2a961c9a78d4c8bf118a0387dc15c564efc8fe9

URL

http[:]//185[.]212[.]128[.]8/B/
http[:]//185[.]212[.]128[.]8/q109[.]exe
http[:]//185[.]212[.]128[.]8/j080[.]exe
http[:]//185[.]212[.]128[.]8/j078[.]exe

Remediation

Block the threat indicators at their respective controls.
Keep all systems and software updated to latest patched versions.
Maintain a strong password policy.