MrDec ransomware

MrDec is a Windows ransomware strain active from May 2018 through at least 2020. Early builds rename each file by adding a 16-character random string between two [ID] tags, for example Export.xlsx [ID]N-ArSYlNe-bU72Vo[ID], and leave an HTML application note called Decoding help.hta. Some later builds name the note Decoder.hta, and builds from 2020 add a random ID followed by _RSA and write Data recovery.hta. The note opens with "You are unlucky!", asks victims to email two contact addresses with their ID and a test file, and asks them to attach C:\Windows\DECODE KEY.KEY. Contact pairs change between builds; ones seen include z.zezet[@]aol.com and z.zezet[@]protonmail.com. MrDec deletes shadow copies, turns off Windows boot recovery and clears event logs before encrypting. It has hit business networks, often through exposed Remote Desktop. It makes no claim of data theft and runs no leak site. It descends from the LockCrypt family.

Sources: In-house research

File extensions: .[ID]DF6Ct7UGnbAW+Yu2[ID], .[ID]Ib72OL+owZgoqCo2[ID], .7fGzlspK2vbZ_RSA, .gOcL7D1kRNbZ_RSA, [ID]UMLylVzeXoL+yE19[ID], [ID]Y6iLw+VASoIgg9g9[ID], [ID]yC-s+QGEllhoMhf9[ID]

Contact addresses: help[.]decryption[@]aol[.]com, help.decryption2020[@]protonmail[.]com, tes1t[@]aol[.]com, tes1t[@]protonmail[.]com, z[.]zezet[@]aol[.]com, z[.]zezet[@]protonmail[.]com

Decryptor: Decryptor availability has not been recorded.

Data exfiltration risk: Undocumented — No MrDec note claims data theft and no leak site is known. It is a 2018 to 2020 file locker that sells the key.

Systems typically targeted: Windows machines, often reached through exposed Remote Desktop. Victims have included businesses with shared files on servers.

Do this first: Isolate the machine and close any Remote Desktop access open to the internet. The note asks victims to send C:\Windows\DECODE KEY[.]KEY, so keep that file along with Decoding help.hta and sample files. The malware deletes shadow copies and clears event logs, so capture what logs remain before rebuilding.

From the ransom note Decoding help.hta:

You are unlucky! The terrible virus has captured your files! For decoding please contact by email tes1t[@]aol[.]com or tes1t[@]protonmail[.]com ***** ****** Your[ID][redacted][ID] ****** 1. In the subject line, write your ID.2. Attach 1-2 infected files that do not contain important information (less than 2 mb)are required to generate the decoder and restore the test file.Hurry up! Time is limited!Attention!!!At the […]