Header image from bleepingcomputer.com
Boldly going where no man has gone before, the Kirk Ransomware brings so much nerdy goodness to the table that it could make anyone in IT interested. Discovered by Avast malware researcher Jakub Kroustek , the Kirk Ransomware is written in Python and may be the first ransomware to utilize Monero as the ransom payment of choice.
Bleeping computer has done a wonderful analysis of it, to read more visit: https://www.bleepingcomputer.com/news/security/star-trek-themed-kirk-ransomware-brings-us-monero-and-a-spock-decryptor/
In case you are not interested in reading the whole post, the Indicators of Compromise:
Files associated with the Kirk Ransomware:
loic_win32.exe
pwd
RANSOM_NOTE.txt
Hashes:
SHA256: 39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc
Targeted File Extensions:
.cfr, .ytd, .sngw, .tst, .skudef, .dem, .sims3pack, .hbr, .hkx, .rgt, .ggpk, .ttarch2, .hogg, .spv, .bm2, .lua, .dff, .save, .rgssad, .scm, .aud, .rxdata, .mcmeta, .bin, .mpqe, .rez, .xbe, .grle, .bf, .iwd, .vpp_pc, .scb, .naz, .m2, .xpk, .sabs, .nfs13save, .gro, .emi, .wad, .15, .vfs, .drs, .taf, .m4s, .player, .umv, .sgm, .ntl, .esm, .qvm, .arch00, .tir, .bk, .sabl, .bin, .opk, .vfs0, .xp3, .tobj, .rcf, .sga, .esf, .rpack, .DayZProfile, .qsv, .gam, .bndl, .u2car, .psk, .gob, .lrf, .lts, .iqm, .i3d, .acm, .SC2Replay, .xfbin, .db0, .fsh, .dsb, .cry, .osr, .gcv, .blk, .4, .lzc, .umod, .w3x, .mwm, .crf, .tad, .pbn, .14, .ppe, .ydc, .fmf, .swe, .nfs11save, .tgx, .trf, .atlas, .20, .game, .rw, .rvproj2, .sc1, .ed, .lsd, .pkz, .rim, .bff, .gct, .9, .fpk, .pk3, .osf, .bns, .cas, .lfl, .rbz, .sex, .mrm, .mca, .hsv, .vpt, .pff, .i3chr, .tor, .01, .utx, .kf, .dzip, .fxcb, .modpak, .ydr, .frd, .bmd, .vpp, .gcm, .frw, .baf, .edf, .w3g, .mtf, .tfc, .lpr, .pk2, .cs2, .fps, .osz, .lnc, .jpz, .tinyid, .ebm, .i3exec, .ert, .sv4, .cbf, .oppc, .enc, .rmv, .mta, .otd, .pk7, .gm, .cdp, .cmg, .ubi, .hpk, .plr, .mis, .ids, .replay_last_battle, .z2f, .map, .ut4mod, .dm_1, .p3d, .tre, .package, .streamed, .l2r, .xbf, .wep, .evd, .dxt, .bba, .profile, .vmt, .rpf, .ucs, .lab, .cow, .ibf, .tew, .bix, .uhtm, .txd, .jam, .ugd, .13, .dc6, .vdk, .bar, .cvm, .wso, .xxx, .zar, .anm, .6, .ant, .ctp, .sv5, .dnf, .he0, .mve, .emz, .e4mod, .gxt, .bag, .arz, .tbi, .itp, .i3animpack, .vtf, .afl, .ncs, .gaf, .ccw, .tsr, .bank, .lec, .pk4, .psv, .los, .civ5save, .rlv, .nh, .sco, .ims, .epc, .rgm, .res, .wld, .sve, .db1, .dazip, .vcm, .rvm, .eur, .me2headmorph, .azp, .ags, .12, .slh, .cha, .wowsreplay, .dor, .ibi, .bnd, .zse, .ddsx, .mcworld, .intr, .vdf, .mtr, .addr, .blp, .mlx, .d2i, .21, .tlk, .gm1, .n2pk, .ekx, .tas, .rav, .ttg, .spawn, .osu, .oac, .bod, .dcz, .mgx, .wowpreplay, .fuk, .kto, .fda, .vob, .ahc, .rrs, .ala, .mao, .udk, .jit, .25, .swar, .nav, .bot, .jdf, .32, .mul, .szs, .gax, .xmg, .udm, .zdk, .dcc, .blb, .wxd, .isb, .pt2, .utc, .card, .lug, .JQ3SaveGame, .osk, .nut, .unity, .cme, .elu, .db7, .hlk, .ds1, .wx, .bsm, .w3z, .itm, .clz, .zfs, .3do, .pac, .dbi, .alo, .gla, .yrm, .fomod, .ees, .erp, .dl, .bmd, .pud, .ibt, .24, .wai, .sww, .opq, .gtf, .bnt, .ngn, .tit, .wf, .bnk, .ttz, .nif, .ghb, .la0, .bun, .11, .icd, .z3, .djs, .mog, .2da, .imc, .sgh, .db9, .42, .vis, .whd, .pcc, .43, .ldw, .age3yrec, .pcpack, .ddt, .cok, .xcr, .bsp, .yaf, .swd, .tfil, .lsd, .blorb, .unr, .mob, .fos, .cem, .material, .lfd, .hmi, .md4, .dog, .256, .eix, .oob, .cpx, .cdata, .hak, .phz, .stormreplay, .lrn, .spidersolitairesave-ms, .anm, .til, .lta, .sims2pack, .md2, .pkx, .sns, .pat, .tdf, .cm, .mine, .rbn, .uc, .asg, .raf, .myp, .mys, .tex, .cpn, .flmod, .model, .sfar, .fbrb, .sav2, .lmg, .tbc, .xpd, .bundledmesh, .bmg, .18, .gsc, .shader_bundle, .drl, .world, .rwd, .rwv, .rda, .3g2, .3gp, .asf, .asx, .avi, .flv, .ai, .m2ts, .mkv, .mov, .mp4, .mpg, .mpeg, .mpeg4, .rm, .swf, .vob, .wmv, .doc, .docx, .pdf, .rar, .jpg, .jpeg, .png, .tiff, .zip, .7z, .dif.z, .exe, .tar.gz, .tar, .mp3, .sh, .c, .cpp, .h, .mov, .gif, .txt, .py, .pyc, .jar, .csv, .psd, .wav, .ogg, .wma, .aif, .mpa, .wpl, .arj, .deb, .pkg, .db, .dbf, .sav, .xml, .html, .aiml, .apk, .bat, .bin, .cgi, .pl, .com, .wsf, .bmp, .bmp, .gif, .tif, .tiff, .htm, .js, .jsp, .php, .xhtml, .cfm, .rss, .key, .odp, .pps, .ppt, .pptx, .class, .cd, .java, .swift, .vb, .ods, .xlr, .xls, .xlsx, .dot, .docm, .dotx, .dotm, .wpd, .wps, .rtf, .sdw, .sgl, .vor, .uot, .uof, .jtd, .jtt, .hwp, .602, .pdb, .psw, .xlw, .xlt, .xlsm, .xltx, .xltm, .xlsb, .wk1, .wks, .123, .sdc, .slk, .pxl, .wb2, .pot, .pptm, .potx, .potm, .sda, .sdd, .sdp, .cgm, .wotreplay, .rofl, .pak, .big, .bik, .xtbl, .unity3d, .capx, .ttarch, .iwi, .rgss3a, .gblorb, .xwm, .j2e, .mpk, .xex, .tiger, .lbf, .cab, .rx3, .epk, .vol, .asset, .forge, .lng, .sii, .litemod, .vef, .dat, .papa, .psark, .ydk, .mpq, .wtf, .bsa, .re4, .dds, .ff, .yrp, .pck, .t3, .ltx, .uasset, .bikey, .patch, .upk, .uax, .mdl, .lvl, .qst, .ddv, .pta
Full ransom note (Courtesy: bleepingcomputer.com)
Mjolnir Security Kirk Ransomware