Dissecting @belogor
Dissecting
@belogor
Agenda
o Fake Antiviruso Ransomware Historyo Cryptolockero Cryptowallo Wrap-up and Q&A
Fake Antivirus timeline
Mac Defender
Antivirus XP 2008
2005 2008 2009 2010 2011 2012 2013 2014
WinFixerPC Optimizer Pro
WinFixer
XP Antivirus 2008
Affiliate Username Account Balance (USD)
nenastniy $158,568.86krab $105,955.76rstwm $95,021.16newforis $93,260.64slyers $85,220.22ultra $82,174.54cosma2k $78,824.88dp322 $75,631.26iamthevip $61,552.63dp32 $58,160.20
2011 - Mac Defender
2011 - Mac Defender
o Pavel Vrublevsky Sentenced to 2.5 Years
2013 – Antivirus Plus
2015 PC Optimizer Pro
PC Optimizer Pro
PGPCoder Trojan – 1024 RSA key, collects money via EGOLD
Bitcoin was invented by Satoshi Nakamoto
Reveton Trojan, aka Police Trojan. collects money via Moneypak
BitCoin becomes popular, Cryptolocker appears
Cryptowall, TeslaCrypt
Ransomware History
2005
2009
2012
2013
2014
TeslaCrypt
TeslaCrypt
TeslaCrypt
Kovter Kovter
Cryptolocker History
September2013
October2013
November 2013
December2013
February 2014
May2014
June2014
Cryptowall, BitCrypt
Android - Simplelocker
Cryptolocker author identified and added to most wanted list
Cryptolocker 2.0
CryptoLocker Decryption Service introducedCryptolocker 1.0
appeared
Poll #1Who does Cryptolocker target?o Governmentso Individualso Corporationso All of the above
What is Cryptolocker?
o Began September 2013 o Encrypts victim’s files, asks for $300 ransomo Impossible to recover files without a keyo Ransom increases after deadlineo Goal is monetary via Bitcoino 250,000+ victims worldwide
(According to Secureworks)
If you see this screen - You are infected
Image source: FBI
Who pays the ransom?
Police department paid $750 to decrypt images and word documents
Who pays the ransom?
In the Australia, a Townsville sex shop paid $1,058 to ransomware attackers.
Cryptolocker Mastermind
According to the FBI, losses are “more than $100 million.”
Image source: FBI
AttributionEvgeniy Mikhailovich Bogachev, 30, of Anapa, Russia. nickname “Slavik” ,indicted for conspiracy, computer hacking, wire fraud, bank fraud, and money laundering .
Bogachev is identified as a leader of a cyber gang of criminals based in Russia and Ukraine that is responsible both GameOver Zeus and Cryptolocker.
Cryptolocker Victims and Damages
o Dell SecureWorks estimates that CryptoLocker has infected 250,000 victims. The average payout is $300 each
o 1 million dollars a day.
o $27 million in ransom in first 2 months (FBI)
Cryptolocker Victims and Damages
Image source: FBI
Poll #2What percentage of victims pay the ransom?o 0.1%o 1%o 25%o 41%
41% of people pay ransom
Data from a Jan 2014 survey by University of Kenthttp://www.cybersec.kent.ac.uk/Survey2.pdf
Cryptolocker overview
z
Bitcoin Ransom Sent C&C
Server
Private Key Sent
Locked Files
Unlocked Files
Cryptolocker analysis- Drops copy of itself in %APPDATA%\{random}.exe
- It creates the following autorun key. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "CryptoLocker":<random>.exe - It creates two processes of itself. The other acts as a watchdog.
Later versions of CryptoLocker create an additional registry entry:HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce "*CryptoLocker":<random>.exe
Cryptolocker C&C
Domain Generation AlgorithmIt uses any of the following TLD for every generated domain:
.com , .net , .biz, .ru , .org , .co.uk , .info
1 23
4
Encrypt Files with the public key flow
5
6
Cryptolocker C&C
CnC - Sinkholed – what does it mean?
CryptoLocker Victims
Filename and Extensions Encrypted by CryptoLocker
Cryptolocker analysis
It searches in all local and remote drives for files to encrypt. All files that are encrypted are also saved in the following registry for record: HKEY_CURRENT_USER\Software\CryptoLocker\Files
The only way to decrypt is to buy the private key from the attackers.
Cryptolocker Ransom
Payment options: moneypak, ukash, cashu, bitcoin
Price: $300 USD or 2 BTC
Cryptolocker 2.0
Original Cryptolocker Cryptolocker 2.0
Compiler C++ .NET
Encryption RSA-2048 RSA-4096
C&C servers Employs DGA No DGA
Payment Scheme moneypak, ucash, cashu, bitcoin bitcoin only
Around December 2013, a new ransomware emerged claiming to be Cryptolocker 2.0. Drops copy of itself in %system%. As msunet.exe
@belogor
Cryptodefense aka Cryptowall
o Cryptodefense is a newer variant of Cryptolocker.o appeared in Feb 2014o no GUIo pops up a webpage, drops text file
o Uses TOR for anonymous payments
CryptoWall 3.0 example
Cryptodefense aka Cryptowall
CryptoWall
Video
Android SimpleLocker
May 2014 – Simplelocker appears in Ukraine- Asks for $22 USD using Monexy- Uses TOR for C&C
Checks SD card for:jpeg, jpg, png, bmp, gif, pdf, doc, docx, txt, avi, mkv, 3gp, mp4
Unlike Cryptolocker, Encryption key is hardcoded on the malware. Encrypted files are appended with “.enc”.
Simplelocker
Image: NioGuard
Summary1. Cryptowall evolved into a major threat allowing criminals to
easily monetize malware infections via Bitcoin
2. Due to current geopolitical situation, Russian attackers will likely continue the barrage against US businesses and individuals while enjoying safe haven in their home country.
3. Cryptowall needs public key to encrypt files so blocking known C&C servers may help prevent data encryption
4. Backup your files! Since decrypting the Cryptowall encrypted files is not impossible frequent backups become even more critical. And keep your backup offline.
Thank You!Twitter: @belogor