ransomhouse

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

rule RansomHouse {
	meta:
		description = "rule to detect RansomHouse"
		author = "ShadowStackRe.com"
		date = "2024-02-20"
		Rule_Version = "v1"
		malware_type = "ransomware"
		malware_family = "RansomHouse"
		License = "MIT License, https://opensource.org/license/mit/"
	strings:
		$strFileExt = ".emario"
		$strRestore = "How To Restore Your Files.txt"
		$strEncrypted = "/path/to/be/encrypted"
		$strCrypted = "Crypted:"
	condition:
		filesize < 100KB and all of ($str*)
}

Welcome to the RansomHouse
                         You are locked by
                            M A R I O
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣴⡾⣻⣿⣿⣿⣿⣯⣍⠛⠻⢷⣦⣀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⠟⢁⣾⠟⠋⣁⣀⣤⡉⠻⣷⡀⠀⠙⢿⣷⣄⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⢀⡀⠀⠀⠀⠀⠀⠀⣰⣿⠏⠀⠀⢸⣿⠀⠼⢋⣉⣈⡳⢀⣿⠃⠀⠀⠀⠙⣿⣦⡀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⢰⡿⠿⣷⡀⠀⠀⠀⣼⣿⠃⠀⠀⣀⣤⡿⠟⠛⠋⠉⠉⠙⢛⣻⠶⣦⣄⡀⠀⠘⣿⣷⡀⠀⠀⠀
⢠⣾⠟⠳⣦⣄⢸⡇⠀⠈⣷⡀⠀⣼⣿⡏⢀⣤⡾⢋⣵⠿⠻⢿⠋⠉⠉⢻⠟⠛⠻⣦⣝⠻⣷⣄⠸⣿⣿⠀⠀⠀
⠘⣧⠀⠀⠀⠙⢿⣿⠀⠀⢸⣷⠀⣿⣿⣧⣾⣏⡴⠛⢡⠖⢛⣲⣅⠀⠀⣴⣋⡉⠳⡄⠈⠳⢬⣿⣿⣿⡿⠀⠀⠀
⠀⠘⠷⣤⣀⣀⣀⣽⡶⠛⠛⠛⢷⣿⣿⣿⣿⣏⠀⠀⡏⢰⡿⢿⣿⠀⠀⣿⠻⣿⠀⡷⠀⣠⣾⣿⡿⠛⠷⣦⠀⠀
⠀⠀⢀⣾⠟⠉⠙⣿⣤⣄⠀⢀⣾⠉⠀⢹⣿⣿⣷⠀⠹⡘⣷⠾⠛⠋⠉⠛⠻⢿⡴⢃⣄⣻⣿⣿⣷⠀⠀⢹⡇⠀
⠀⠀⢸⡇⠈⠉⠛⢦⣿⡏⠀⢸⣧⠀⠈⠻⣿⡿⢣⣾⣦⣽⠃⠀⠀⠀⠀⠀⠀⠀⣷⣾⣿⡇⠉⢿⡇⠀⢀⣼⠇⠀
⠀⠀⠘⣷⡠⣄⣀⣼⠇⠀⠀⠀⠻⣷⣤⣀⣸⡇⠀⠹⣿⣿⣦⣀⠀⠀⠀⠀⢀⣴⣿⣿⡟⠀⠀⢸⣷⣾⡿⠃⠀⠀
⠀⠀⠀⠈⠻⢦⣍⣀⣀⣀⡄⠀⣰⣿⡿⠿⢿⣇⠀⠀⠉⠛⠻⣿⣿⡷⠾⣿⣿⡿⠉⠁⠀⠀⢀⣾⠋⠁⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠈⠉⠉⠙⠿⢿⣿⣇⠀⠀⠈⢿⣧⣄⠀⠀⠀⢹⣷⣶⣶⣾⣿⡇⠀⠀⣀⣴⡿⣧⣄⡀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢿⣷⡀⠀⠀⠙⢿⣿⣶⣤⡀⠻⢤⣀⡤⠞⢀⣴⣿⣿⠟⢷⡀⠙⠻⣦⣄⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢻⣦⠀⢠⡟⠁⠙⢻⣿⠷⠶⣶⠶⠾⠛⠙⣿⠇⠀⠀⢻⡄⠀⠀⠙⢷⡀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣸⣿⡀⣿⠁⣤⣤⡄⢻⡶⠶⠛⠛⠛⠛⠛⣿⢠⣾⣷⣆⢻⡀⠀⠀⠈⣷
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⢸⣿⣿⣿⡈⢿⡀⠀⠀⠀⠀⠀⡿⢸⣿⣿⣿⢸⡇⠀⠀⠀⡟
Dear management,
If you are reading this message, it means that:
- your network infrastructure has been compromised,
- critical data was stolen,
- files are encrypted.
The best and only thing you can do is to contact us
to settle the matter before any losses occurs.
Check out our website:[redactado]
[redactado] Channel: [redactado]
-------------------------------------
                    1. THE FOLLOWING IS STRICTLY FORBIDDEN
1.1 EDITING FILES ON HDD.
                       Renaming, copying or moving any files
                       could DAMAGE the cipher and
                       decryption will be impossible.
1.2 USING THIRD-PARTY SOFTWARE.
                       Trying to recover with any software
                       can also break the cipher and
                       file recovery will become a problem.
1.3 SHUTDOWN OR RESTART THE PC.
                       Boot and recovery errors can also damage the cipher.
                       Sorry about that, but doing so is entirely at your own risk.
-------------------------------------
            2. EXPLANATION OF THE SITUATION
2.1 HOW DID THIS HAPPEN
The security of your IT perimeter has been compromised (it's not perfect at all).
We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks.
We spent a lot of time researching and finding out the most important directories of your business, your weak points.
We have already downloaded a huge amount of critical data and analyzed it. Now its fate is up to you, it will either be deleted or sold, or shared with the media.
2.2 VALUABLE DATA WE USUALLY STEAL:
            - Databases, legal documents, personal information.
            - Audit reports.
            - Any financial documents (Statements, invoices, accounting, transfers,e-mails, etc.).
            - Work files and corporate correspondence.
            - Any backups.
	    - Confidential documents.
2.3 TO DO LIST (best practies)
            - Contact us as soon as possible.
            - Contact us only in our live chat, otherwise you can run into scammers.
            - Purchase our decryption tool and decrypt your files. There is no other way to do this.
            - Realize that dealing with us is the shortest way to success and secrecy.
            - Give up the idea of using decryption help programs, otherwise you will destroy the system permanently.
            - Avoid any third-party negotiators and recovery groups. They can become the source of leaks.
-------------------------------------
            3. POSSIBLE DECISIONS
3.1 NOT MAKING THE DEAL
            - After 5 days starting tomorrow your leaked data will be Disclosed or sold.
            - We will also send the data to all interested supervisory organizations and the media.
            - Decryption key will be deleted permanently and recovery will be impossible.
            - Losses from the situation can be measured based on your annual budget.
3.2 MAKING THE WIN-WIN DEAL
            - You will get the only working Decryption Tool and the how-to-use Manual.
            - You will get our guarantees (with log provided) of non-recovarable deletion 

• https://www.ransomware.live/group/ransomhouse

• Healthcare
  2
• Financial Services
  2
• Consumer Services
  1
• Agriculture and Food Production
  1