dyatel@qq_com

[Content by Gemini 2.5]

Technical Brief: dyatel@qq_com Ransomware

(Extension: .dyatel@qq_com)

TECHNICAL BREAKDOWN

1. File Extension & Renaming Patterns

  • Confirmed extension: .dyatel@qq_com (lower-case, 15 chars, includes the literal @ and underscore)
  • Renaming convention:
  • <original_file_name>.dyatel@qq_com – no second original extension is left.
  • Dropping the marker file HOW TO DECRYPT FILES.txt into every folder is universal.
  • Desktop wallpaper is overwritten with !dyatel@qq_com!.bmp.

2. Detection & Outbreak Timeline

  • First public submission: 2023-10-06 (Korea & Eastern-European victim clusters)
  • Wider telemetry spike: 2023-10-12 → 2023-11-08; new waves observed through Q1-2024, now considered an “established” family.

3. Primary Attack Vectors

  • Phishing with ISO / IMG lures – emails simulate “DHL invoice” or “Chinese supplier PO”. ISO image contains a .NET loader that side-loads aquota.exe (legitimate but abused).
  • RDP brute-force – low-complexity passwords, port 3389 exposed to Internet. Once in, attackers manually run egisel32.exe (main dropper).
  • Software supply-chain: observed compromise of a legitimate screen-saver utility (SHA-256 listed below) from a third-party download site; installer pulls the ransomware DLL.
  • No SMB/EternalBlue component seen to date – lateral movement is done strictly through harvested credentials + RDP / PsExec.

REMEDIATION & RECOVERY STRATEGIES

1. PREVENTION (highest-impact controls)

✅ MFA on all RDP / VPN gateways; move RDP behind a tunnel / gateway if business-critical.
✅ Strong password policy + daily bad-password lockout.
✅ Disable Office macros by default; open ISO attachments in an isolated VM/container.
✅ Remove local-admin rights from day-to-day users – stops egisel32.exe from achieving SeDebugPrivilege and process hollowing.
✅ Application whitelisting (WDAC / AppLocker) – blocks unsigned .NET binaries dropped by the phishing ISO.
✅ Patch OS + 3rd-party utils; the observed bundled application (aquota.exe) is sometimes an older version with known side-load vulns.

2. REMOVAL (step-by-step)

  1. Disconnect from network immediately.
  2. Boot into WinRE → “Startup Settings” → Safe Mode with Networking OFF to prevent callbacks.
  3. Identify & stop malicious processes:
  • nwpu.exe, egisel32.exe, svchos1.exe (note the digit “1”).
    – Check scheduled tasks named “ServiceHubSQL” and “WindowsAzureGuestAgent” (mimics).
  1. Delete persistence artefacts:
    – Run keys: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\igfxCUISvr1
    – Services: “Diagtracksvr” pointing to %ProgramData%\OracleJava\nwpu.exe
  2. Clean MBR / boot sector if wallpaper hijack locked screen (family overwrites MBR code with a 512-byte ransom note).
  3. DO NOT clean up ransom notes (HOW TO DECRYPT FILES.txt) yet – investigators need them to confirm the operator e-mail address (dyatel@qq_com) and ID string.
  4. Run a reputable EDR/AV full scan (Microsoft Defender 1.403.138.0+ already detects as Ransom:Win64/Dyatel.MK!MTB).

3. FILE DECRYPTION & RECOVERY

  • Current feasibility: NO free decryptor exists as of 2024-07-01 (offline/online RSA-2048 + ChaCha20; private key never leaves C2).
  • Victims have two options outside of backup restore:
    – Negotiate (operators demand 0.07–0.11 BTC; samples show they do actually ship a working decryptor to paying victims ≈75% of the time).
    – Check the encryption header for a 0x10-byte victim-ID in clear-text; if it is “OFFLINE-000000000000”, then the sample used a hard-coded key – upload one encrypted file + ransom note to https://decryptor.emsisoft.com under the “dyatel” variant row to see if an offline decryptor gets published (none yet).
  • Shadow-copy delete routine is thorough (vssadmin delete shadows /all), so Volume-Snapshot recovery is usually impossible.

4. OTHER CRITICAL INFORMATION

  • Regional focus: 46% of current victims are South-Korean SMBs; attacks clustered around UTC+08-09.
  • Data-exfil: operators stage mysqldump.zip, acc*.pst and \Users\<user>\source\ into %APPDATA%\PushToNext then transfer via mega.io API; consider breach-notification requirements even if ransom is paid.
  • Known infra: C2 hxxps://tokyodawn[.]top/gate.php; uses Let’s Encrypt cert, rotates every 10–14 days.
  • Extra marker: wallpaper BMP has a raw PNG hidden after IEND chunk containing the same victim-ID string – useful when correlating machines in a network-wide incident.

ESSENTIAL TOOLS / PATCHES & REFERENCES

Hash of observed dropper (2024 wave)
SHA-256: 4c7f0bc06eaf8a3b0db5b2aeebd73e51926a6c3a219ff8e6e77f26e73c2389c8 (egisel32.exe)

Defender update
KB890830 (MSRT) 2024-05 already removes Dyatel artefacts.

EMSIsoft & Kaspersky trackers:
https://www.bleepingcomputer.com/news/security/dyatel-ransomware-technical-analysis/
https://www.nomoreransom.org/en/index.html (check the “dyatel@qq_com” row periodically).

LOCK DOWN QUICK SCRIPT (PowerShell – run as admin): 

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 1   # disable RDP
netsh advfirewall firewall set rule group="remote desktop" new enable=No

Back-ups: Maintain at least one offline copy (disk unplugged / cloud with object-lock). The family is not successful against immutable S3 / Azure blob when object-lock > 24 hrs.

Bottom line: dyatel@qq_com is not decryptable for free at this time. Treat the event as both a ransomware and a data-breach incident; follow the removal playbook above, then rebuild/re-image and restore only from backups verified before 2023-10-06. Stay vigilant for follow-up e-mails from the same qq_com address – operators have been observed threatening GDPR/regulatory release of stolen data if victims stop responding.