Matrix Ransomware

Matrix, also known as Ann, is ransomware that has been frequently updated since December 2016.

Matrix has been distributed using a range of methods including spam email campaigns, the RIG exploit kit and hacked remote desktop services.

When Matrix is executed it encrypts the user’s files and filenames, including on network shares. Matrix then uploads statistics on the types of files that were encrypted to its command and control server. To undermine recovery by the user Matrix deletes Shadow Volume copies and disables recovery options on the affected device, with some variants also overwriting all free space on the storage volume.

Some variants of Matrix can propagate further by using shortcuts. During the encryption process, these variants hide a folder and then create a shortcut using the folder’s icon and name to fool users into executing the ransomware. These malicious shortcuts are created on network shares and removable drives, which can result in the ransomware being executed across the local network.

Despite some differences, both new versions of Matrix encrypt filenames and unmapped network shares, clear Volume Shadow Copies, and display status windows during the encryption process. Encrypted filenames will be appended with [Files4463[@]tuta[.]io] or [RestorFile[@]tutanota[.]com], depending on which variant infects the machine.

The ransomware is being installed through exploit kits which target vulnerabilities in Internet Explorer (CVE-2016-0189) and Flash (CVE-2015-8651).

Ransom Note Text:

WHAT HAPPENED WITH YOUR FILES?
Your documents, databases, backups, network folders and other important files are encrypted with RSA-2048 and AES-128 ciphers.
More information about the RSA and AES can be found here:
http://en.wikipedia.org/wiki/RSA_(cryptosystem)
http://en.wikipedia.org/wiki/Advanced_Encryption_Standard
It mеаns thаt yоu will nоt bе аblе tо аccеss thеm аnуmоrе until thеу аrе dесrуptеd with yоur pеrsоnаl dесrуptiоn kеy! Withоut уоur pеrsоnаl kеy аnd sреciаl sоftwаrе dаtа rеcоvеrу is impоssiblе! If yоu will fоllоw оur instruсtiоns, wе guаrаntее thаt yоu cаn dесryрt аll yоur filеs quiсkly аnd sаfеly!
If yоu wаnt tо rеstоrе yоur filеs, plеаsе writе us tо thе е-mаils:
[email protected]
[email protected]
[email protected]
In subjеct linе оf your mеssаgе writе yоur pеrsоnаl ID:
4292D68970C047D9
Wе rесоmmеnd yоu tо sеnd yоur mеssаgе ОN ЕАСH оf ОUR 3 ЕМАILS, duе tо thе fасt thаt thе mеssаgе mау nоt rеаch thеir intеndеd rеcipiеnt fоr а vаriеtу оf rеаsоns!
Plеаsе, writе us in Еnglish оr usе prоfеssiоnаl trаnslаtоr!
If yоu wаnt tо rеstоrе yоur filеs, yоu hаvе tо pаy fоr dесrуptiоn in Bitсоins. Thе pricе dереnds оn hоw fаst уоu writе tо us.
Your message will be as confirmation you are ready to pay for decryption key. After the payment you will get the decryption tool with instructions that will decrypt all your files including network folders.
Tо cоnfirm thаt wе cаn dесryрt yоur filеs yоu cаn sеnd us up tо 3 filеs fоr frее dесrурtiоn. Plеаsе nоte thаt filеs fоr frее dесrурtiоn must NОT cоntаin аnу vаluаblе infоrmаtiоn аnd thеir tоtаl sizе must bе lеss thаn 5Mb.
Yоu hаvе tо rеspоnd аs sооn аs pоssiblе tо еnsurе thе rеstоrаtiоn оf yоur filеs, bеcаusе wе wоnt kееp yоur dеcrуptiоn kеys аt оur sеrvеr mоre thаn оne wееk in intеrеst оf оur sеcuritу.
Nоtе thаt аll thе аttеmpts оf dесryptiоn by yоursеlf оr using third pаrty tооls will rеsult оnly in irrеvосаble lоss оf yоur dаtа.

If yоu did nоt rеcеivе thе аnswеr frоm thе аfоrеcitеd еmаils fоr mоrе then 6 hours, рlеаsе сhеck SРАМ fоldеr!
If yоu did nоt rеcеivе thе аnswеr frоm thе аfоrеcitеd еmаils fоr mоrе then 12 hours, рlеаsе trу tо sеnd уоur mеssаgе with аnоthеr еmаil sеrviсе!
If yоu did nоt rеcеivе thе аnswеr frоm thе аfоrеcitеd еmаils fоr mоrе then 24 hours (еvеn if уоu hаvе prеviоuslу rесеivеd аnswеr frоm us), рlеаsе trу tо sеnd уоur mеssаgе with аnоthеr еmаil sеrviсе tо еасh оf оur 3 еmаils!
Аnd dоn't fоrgеt tо chеck SPАМ fоldеr!

URL’s

stat3.s76.r53[.]com[.]ua/addrecord.php

stat3.s76.r53[.]com[.]ua/uploadextlist.php

Associated Email addresses:

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Duncan

Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.