Zanza Ransomware via admins124

[gwynne]

Never been to this site or heard about it until last night when my server was hit, but would like to post this for others and hopefully a fix will become available and help someone else.  I believe they gained access somehow in correlation with MSSQL.  A new user was created called "admins124".  They established group policies and installed all necessary software to complete the attack.  Only files above 10mb were encrypted.  This computer only acts as a server for my accounting program and as storage for older files.  They did wreck havoc on the SQL server, and we will lose some baby videos of my first born, but the database will be rebuilt and my wife and I still blessed to have our kids with us.  Ransom note required I email himydata@tutamail.com with my reference code.  I did, and they are requesting one BTC with 24hrs or two afterwards.  Not doing it.  About to start the process of cleaning/wiping and re-establishing this server.  Already patched a couple of ports that were open due to the accounting program and how my company processes timecards.  As far as the SQL server, going to try to really dig into what's venerable there and get it fortified.  I also believe they were working for the last two/three weeks at trying to get it.  My security camera would have outages at nights multiple times that would drive me insane.  Talking with our provider, they couldn't figure out what was going on, but today had mentioned some irregular traffic had came in over the weekend, which is when I was hit.  Ultimately, I think it was them messing with my setup trying to find the mousehole.

 

I can post some sample data if anyone is interested.  The ransom note is attached.  Thank you all!

----Read-Me-----.txt

[gwynne]

....also went to id-ransomware.malwarehunterteam.com and did not have luck.  Great site though and hope I never have to use it again.

[Porthos]

This section is for submitting actual files that encrypted the server. Do you have any of those?

[gwynne]

Agh, my bad.  I do not.

Reviewing last nights notes, I noticed it used Mimic 6.3 to autorun the attack, AD.exe and Everything files.  There is a decent size Everything.db file in the user account now.  I don't know what that contains.

 

[David H. Lipman]

Moved to;  General Chat

Reference:
ID Ransomware - Identify What Ransomware Encrypted Your Files

Unfortunately, there is not much else this Forum can do for one who has been victimized by Ransomware.