App Review An Interlude with HMPA

[cruelsister]

 

[SHvFl]

Forgot the video in private

 

[omidomi]

ops,Video not Play here

 

[cruelsister]

Apologies- I didn't take it out of Private.

Also if anyone out there sees a few instances of explorer.exe running this probably is not a good thing.

 

[SHvFl]

Nice video. Don't know what kind of ransomware bart is but hopefully the new version of HMPA that it's in beta now will solve it. If i remember correctly they improved the anti ransomware module.

 

[DardiM]

Nice video. Don't know what kind of ransomware bart is but hopefully the new version of HMPA that it's in beta now will solve it. If i remember correctly they improved the anti ransomware module.

Spoiler: Infos about Bart ransomware

Bart Ransomware Description
The Bart Ransomware is not your typical Encryption Trojan and should be described as a Compression Trojan. The Bart Ransomware is a threat that uses the DEFLATE compression algorithm to pack the user's data into a password protected ZIP archive file and append the .bart.zip file extension. For example, the file TestObj.png will be archived as TestObj.png.beart.zip and users will not be able to open it unless they have the correct password.

Malware researchers reveal that the Bart Ransomware is developed by the same team operating Dridex and the Locky Ransomware. The Bart Trojan may be deployed to users via spam emails that are designed to appear as notifications from social media regarding recent uploads to your profile. The spam email is loaded with a ZIP file titled 'Photos' that has embedded JavaScript. The script acts as a two-stage infection procedure and is executed in the memory directly. The script downloads and runs a Trojan-Downloader like Bartalex, which installs the Bart Ransomware on the compromised PC.

Since the Bart Ransomware is using the DEFLATE compression algorithm to lock your files you might notice slower computer performance and prompts to allocate more virtual memory to your OS. The Bart Ransomware is known to target more than one hundred and forty file formats including:

.3DM, .3DS, .3G2, .3GP, .602, .AES, .ARC, .ASC, .ASF, .ASM, .ASP, .AVI, .BAK, .BAT, .BMP, .BRD, .CGM, .CMD, .CPP, .CRT, .CSR, .CSV, .DBF, .DCH, .DIF, .DIP, .DJV, .DJVU, .DOC, .DOCB, .DOCM, .DOCX, .DOT, .DOTM, .DOTX, .FLA, .FLV, .FRM, .GIF, .GPG, .HWP, .IBD, .JAR, .JAVA, .JPEG, .JPG, .KEY, .LAY, .LAY6, .LDF, .M3U, .M4U, .MAX, .MDB, .MDF, .MID, .MKV, .MOV, .MP3, .MP4, .MPEG, .MPG, .MS11, .MYD, .MYI, .NEF, .ODB, .ODG, .ODP, .ODS, .ODT, .OTG, .OTP, .OTS, .OTT, .P12, .PAQ, .PAS, .PDF, .PEM, .PHP, .PNG, .POT, .POTM, .POTX, .PPAM, .PPS, .PPSM, .PPSX, .PPT, .PPTM, .PPTX, .PSD, .RAR, .RAW, .RTF, .SCH, .SLDM, .SLDX, .SLK, .STC, .STD, .STI, .STW, .SVG, .SWF, .SXC, .SXD, .SXI, .SXM, .SXW, .TAR, .TBK, .TGZ, .TIF, .TIFF, .TXT, .UOP, .UOT, .VBS, .VDI, .VMDK, .VMX, .VOB, .WAV, .WB2, .WK1, .WKS, .WMA, .WMV, .XLC, .XLM, .XLS, .XLSB, .XLSM, .XLSX, .XLT, .XLTM, .XLTX, .XLW, .ZIP.

An unusual trait of the Bart Ransomware is that it uses the users' locale settings to determine if their data should be locked. The Bart Ransomware is coded to delete itself if it is running on machines of Russian, Ukrainian and Belorussian users. Other users may not be so lucky and will be provided with a ransom note in the form of recover.bmp and recover.txt that features the following message:

'!!! IMPORTANT INFORMATION !!!
All your files are encrypted.
Decrypting of your files is only possible with the private key, which is on our secret server.
To receive your private key follow one of the links:
[links to TOR-hosted pages]
If all addresses are not available, follow these steps:
[instructions on how to install the TOR Browser and access the payment portal]
!!! Your personal identification ID: [128-bit long identifier] !!!'

The Bart Ransomware is not likely to damage the Shadow Volume Copies and protected storage on your system. Therefore, you should be able to use those to recover your data. Services like Google Drive and Microsoft's OneDrive can aid you in keeping your files safe from the Bart Ransomware. Malware researchers note that paying the ransom is not a good idea because you are not likely to receive the password for your files and you online profiles may be compromised while the Bart Ransomware is running on your PC. You should place your trust into a reputable anti-malware solution that can purge the Bart Trojan and protect your OS from unauthorized manipulation.

 

[Rishi]

The newest threats always somehow manage to evade security software, a blind spot for sure.Thank you for the video, great work as usual!

 

[hjlbx]

Nice video. Don't know what kind of ransomware bart is but hopefully the new version of HMPA that it's in beta now will solve it. If i remember correctly they improved the anti ransomware module.

I recall this is on SurfRight's "To Do" list:

1. Petya type
2. Type that trashes system
3. Copy original, rename original, delete original, save copy
4. Ransomware that installs a service

I wouldn't expect beta 3.5 any time soon... but I could be wrong.

* * * * *

The best parts of HMP.A are not its anti-ransomware - although that is what it is best known for...

 

[SHvFl]

I recall this is on SurfRight's "To Do" list:

1. Petya type
2. Type that trashes system
3. Copy original, rename original, delete original, save copy
4. Ransomware that installs a service

I wouldn't expect beta 3.5 any time soon... but I could be wrong.

* * * * *

The best parts of HMP.A are not its anti-ransomware - although that is what it is best known for...

I think they are beta testing it now on the other forum and the link for the beta is only over pm. Maybe that is why you didn't notice.

Spoiler: Infos about Bart ransomware

Bart Ransomware Description
The Bart Ransomware is not your typical Encryption Trojan and should be described as a Compression Trojan. The Bart Ransomware is a threat that uses the DEFLATE compression algorithm to pack the user's data into a password protected ZIP archive file and append the .bart.zip file extension. For example, the file TestObj.png will be archived as TestObj.png.beart.zip and users will not be able to open it unless they have the correct password.

Malware researchers reveal that the Bart Ransomware is developed by the same team operating Dridex and the Locky Ransomware. The Bart Trojan may be deployed to users via spam emails that are designed to appear as notifications from social media regarding recent uploads to your profile. The spam email is loaded with a ZIP file titled 'Photos' that has embedded JavaScript. The script acts as a two-stage infection procedure and is executed in the memory directly. The script downloads and runs a Trojan-Downloader like Bartalex, which installs the Bart Ransomware on the compromised PC.

Since the Bart Ransomware is using the DEFLATE compression algorithm to lock your files you might notice slower computer performance and prompts to allocate more virtual memory to your OS. The Bart Ransomware is known to target more than one hundred and forty file formats including:

.3DM, .3DS, .3G2, .3GP, .602, .AES, .ARC, .ASC, .ASF, .ASM, .ASP, .AVI, .BAK, .BAT, .BMP, .BRD, .CGM, .CMD, .CPP, .CRT, .CSR, .CSV, .DBF, .DCH, .DIF, .DIP, .DJV, .DJVU, .DOC, .DOCB, .DOCM, .DOCX, .DOT, .DOTM, .DOTX, .FLA, .FLV, .FRM, .GIF, .GPG, .HWP, .IBD, .JAR, .JAVA, .JPEG, .JPG, .KEY, .LAY, .LAY6, .LDF, .M3U, .M4U, .MAX, .MDB, .MDF, .MID, .MKV, .MOV, .MP3, .MP4, .MPEG, .MPG, .MS11, .MYD, .MYI, .NEF, .ODB, .ODG, .ODP, .ODS, .ODT, .OTG, .OTP, .OTS, .OTT, .P12, .PAQ, .PAS, .PDF, .PEM, .PHP, .PNG, .POT, .POTM, .POTX, .PPAM, .PPS, .PPSM, .PPSX, .PPT, .PPTM, .PPTX, .PSD, .RAR, .RAW, .RTF, .SCH, .SLDM, .SLDX, .SLK, .STC, .STD, .STI, .STW, .SVG, .SWF, .SXC, .SXD, .SXI, .SXM, .SXW, .TAR, .TBK, .TGZ, .TIF, .TIFF, .TXT, .UOP, .UOT, .VBS, .VDI, .VMDK, .VMX, .VOB, .WAV, .WB2, .WK1, .WKS, .WMA, .WMV, .XLC, .XLM, .XLS, .XLSB, .XLSM, .XLSX, .XLT, .XLTM, .XLTX, .XLW, .ZIP.

An unusual trait of the Bart Ransomware is that it uses the users' locale settings to determine if their data should be locked. The Bart Ransomware is coded to delete itself if it is running on machines of Russian, Ukrainian and Belorussian users. Other users may not be so lucky and will be provided with a ransom note in the form of recover.bmp and recover.txt that features the following message:

'!!! IMPORTANT INFORMATION !!!
All your files are encrypted.
Decrypting of your files is only possible with the private key, which is on our secret server.
To receive your private key follow one of the links:
[links to TOR-hosted pages]
If all addresses are not available, follow these steps:
[instructions on how to install the TOR Browser and access the payment portal]
!!! Your personal identification ID: [128-bit long identifier] !!!'

The Bart Ransomware is not likely to damage the Shadow Volume Copies and protected storage on your system. Therefore, you should be able to use those to recover your data. Services like Google Drive and Microsoft's OneDrive can aid you in keeping your files safe from the Bart Ransomware. Malware researchers note that paying the ransom is not a good idea because you are not likely to receive the password for your files and you online profiles may be compromised while the Bart Ransomware is running on your PC. You should place your trust into a reputable anti-malware solution that can purge the Bart Trojan and protect your OS from unauthorized manipulation.

Thanks. What i meant is that if it's the kind HMPA 3.5 will cover.

 

[hjlbx]

I think they are beta testing it now on the other forum and the link for the beta is only over pm. Maybe that is why you didn't notice.


Thanks. What i meant is that if it's the kind HMPA 3.5 will cover.

I am currently beta testing 3.5; no ETA on RC - so stable release I expect months from now...

 

[SHvFl]

I am currently beta testing 3.5; no ETA on RC - so stable release I expect months from now...

Oh that is what you meant. Cool, i misunderstood you. Sorry.

 

[cruelsister]

As the newest HMPA is a private beta, both Honor and the EULA prevented me from using or discussing it. This video and another one I will be releasing out of order on Tuesday should assist in making a fine product better (think Tough Love). Also note that a scan with HMP after this alert would have cleaned up the InfoStealer including the persistence entries.

 

[hjlbx]

Yeah... SurfRight needs to play catch-up...

 

[Duotone]

Nice video, first time I saw that kind of blocking by HMP.A...

The best parts of HMP.A are not its anti-ransomware

Anti-ransomware is really not its best feature, Put HMP.A back in my set-up after seeing this video.

Classical music... Nice!

 

[hjlbx]

Nice video, first time I saw that kind of blocking by HMP.A...


Anti-ransomware is really not its best feature, Put HMP.A back in my set-up after seeing this video.

Classical music... Nice!

HMP.A is good soft overall...

 

[Duotone]

HMP.A is good soft overall...

True

Just remembered why I removed it, I was testing Voodooshield.

 

[Deleted member 178]

nice video, i like the info-stealer detailed warnings.

 

[cruelsister]

And the Red border around the browser window is a really nice touch.

Duo- the music was Vivaldi's Concerto No. 4 in F minor L'inverno (Winter) Allegro non molto. This was done by an amateur orchestra- but I love how thy attack the piece instead of just playing it.