Rannoh

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Rannoh
Alias	Trustezeb
Group	Police lock
Parent
Sibling
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns:
Target	Microsoft Windows
Origin
Distribution vector
UserAgent	Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)
CCProtocol	HTTP (Centralized)
Activity	2012 /
Status
Language
Programming language
Operation/Working group

Introduction

Rançongiciel qui chiffre les fichiers du disque dur et les renommes sous la forme: “locked-<nom original>.<4 caractères aléatoire>”

 MD5: c36c46f4de045ef332decc006694db6e
 MD5: 81ff324d2023d8ecb98a127b87d51450
 MD5: 51b046256db58b603a27eba8dee05479 2013-01-18

C&C Call

 manualvilvotakano .com/una2/SF6344-GWXS-WEQOZ6.php?ltype=lk&id=[REDACTED]&ver=02.063&win=Windows_7_(64_bit)&loc=0x0409&cmd=pcc  2013-01-18
 manualvilvotakano .com/una2/SF6344-GWXS-WEQOZ6.php?ltype=lk&id=[REDACTED]&ver=02.063&win=Windows_7_(64_bit)&loc=0x0409&cmd=msg  2013-01-18

Features

Associated images

Matsnu DE (05-2012)
Matsnu DE (06-2012)
Matsnu DE (08-2012)
Matsnu DE bis (06-2012)
Matsnu ES (05-2012)
Matsnu FR (05-2012)
Matsnu FR (07-2012)
Matsnu FR (08-2012)
Matsnu IT (06-2012)
Matsnu IT (08-2012)
Matsnu UK (01-2013)
Matsnu UK (05-2012)
Matsnu UK (08-2012)

Checksums / AV databases

Publications

	Author	Editor	Year
Attention! All data on your hardrive is encrypted	Tomas Prochazka Michal Cebak	AVG	2013
Etude sur le fonctionnement du Trojan.Matsnu.1 codant les données des utilisateurs		Dr.Web	2012
Malware analysis Rannoh/Matsnu	Paul Rascagnères Hugo Caron	Malware.lu	2012
Ransomware ‘Holds Up’ victims	Sravan Ganachari	McAfee	2012
Reversing malware loaders - The Matsnu-A Case	Kyriakos Economou		2012
What’s the buzz with Bafruz		Microsoft	2012