Thread Info
  • State Not Answered
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 4 replies
  • Subscribers 5 subscribers
  • Views 4151 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

MERRY_I_LOVE_YOU_BRUCE.hta ransomware

kingswaygroup

A customer with Sophos Endpoint 10.6 has just dropped off his laptop.   He picked up a ransomware virus on some furniture website that has seemingly encrypted program files in his machine and renamed or created files with a .MERRY extension.   It also leaves an HTML application file named MERRY_I_LOVE_U_BRUCE in all folders with application files. I have not seen any documents that have been touched yet.   The virus came in when he tried to view a file and it claimed the classic "you need to download this font to view the document" message.

In searching the web tonight I can only see a few postings and all seem to be vague, then point to SPYHUNTER.   I don't like playing around further so I will not touch that.

Has anyone seen anything on this campaign or know what can be done with it.   Of course this is the one system that I don't have access to where I would normally have backups and the system restore files have been deleted.

I don't have my equipment here to image the drive so I won't play around with it quite yet.

 



This thread was automatically locked due to age.
Parents
  • 0

    Hello kingswaygroup,

    encrypted program files (which ones), application files (belonging to what applications and are they encrypted), but not documents? Doesn't sound like your average ransomware.
    I'd boot with a Linux Live distribution, copy some of the encrypted stuff, search for suspicious files (in temp, cache, appdata folders) from around the time of the "visit" and submit the samples, also send the URL with your submission.

    Christian 

Reply
  • 0

    Hello kingswaygroup,

    encrypted program files (which ones), application files (belonging to what applications and are they encrypted), but not documents? Doesn't sound like your average ransomware.
    I'd boot with a Linux Live distribution, copy some of the encrypted stuff, search for suspicious files (in temp, cache, appdata folders) from around the time of the "visit" and submit the samples, also send the URL with your submission.

    Christian 

Children
No Data