Spora Ransomware

BeSecure · 2017-01-11T08:23:55.000Z

Spora Ransomware

SHA256: 3fb2e50764dea9266ca8c20681a0e0bf60feaa34a52699cf2cf0c07d96a22553
File name: spora.hta
Detection ratio: 9 / 55
Analysis date: 2017-01-11 08:20:29 UTC ( 0 minutes ago )
V.T-https://www.virustotal.com/en/file/3fb2e50764dea9266ca8c20681a0e0bf60feaa34a52699cf2cf0c07d96a22553/analysis/1484122829/
Avast failed to block this new sample(Ransomware). SUD to Avast Lab.

[b]Malware Analysis Report: https://www.hybrid-analysis.com/sample/3fb2e50764dea9266ca8c20681a0e0bf60feaa34a52699cf2cf0c07d96a22553?environmentId=100[/b]

system · 2017-02-16T06:44:24.000Z

How do I get rid of this Malware? Avast does not even pick it up! :-[

Pondus · 2017-02-16T07:03:00.000Z

Dirk66 post:2:

How do I get rid of this Malware? Avast does not even pick it up! :-[

Follow instructions here >> https://forum.avast.com/index.php?topic=194892.0
Then start your own topic and attach requested logs

system · 2017-02-16T07:27:49.000Z

i have test in vmware , avast blocked this ransomware . but avast doesnt delete the sample like .hta , .js

TrueIndian · 2017-02-16T10:55:26.000Z

I think its better off sending the undetected files to submit AT virus DOT avast DOT com.

Avast is detecting spora by the way:
https://virustotal.com/en/file/2637247ad66e6e57a68093528bb137c959cdbb438764318f09326fc8a79bdaaf/analysis/
https://virustotal.com/en/file/3251403ff9848ed520230a0fb8979ea4b5c8a4aa4e4a392da4c4458390f040db/analysis/

@ymchen did behav. shield pick up on the js file? because it should

Eddy · 2017-02-16T10:56:58.000Z

https://www.avast.com/faq.php?article=AVKB258

TrueIndian · 2017-02-16T11:02:54.000Z

FYI I found the .hta and js file that was reported and I have mailed it to avast

Ymchen,keep me posted on whether behav. shield picks it up or not.

system · 2017-02-16T12:09:21.000Z

TI199 post:5:

I think its better off sending the undetected files to submit AT virus DOT avast DOT com.

Avast is detecting spora by the way:
https://virustotal.com/en/file/2637247ad66e6e57a68093528bb137c959cdbb438764318f09326fc8a79bdaaf/analysis/
https://virustotal.com/en/file/3251403ff9848ed520230a0fb8979ea4b5c8a4aa4e4a392da4c4458390f040db/analysis/

@ymchen did behav. shield pick up on the js file? because it should

this sample not a js file ,the file name extension is .hta , so behaviour shield doesnt pick up . i have test other new sample like .js file successfully blocked and quarantine sample by behaviour shield.

HonzaZ · 2017-02-16T15:52:24.000Z

I blocked the .hta files that TI199 sent me

TrueIndian · 2017-02-16T16:07:33.000Z

HonzaZ post:9:

I blocked the .hta files that TI199 sent me

Thanks for protecting us!

Nice to hear ymchen

Announcements