Reply to thread

Message: <blockquote data-quote="Geniu" data-source="post: 367" data-attributes="member: 13">Ryuk is a ransomware code that encrypts files and requires victims to pay in bitcoins in order to provide decryption keys. Used exclusively for targeted attacks. This ransomware was first detected in August 2018 as part of a campaign targeting multiple companies. Our specialists analyzed the initial versions of the malware and identified similarities and common fragments of the source code with the Hermes ransomware. Hermes is a mass distribution ransomware that is sold on underground forums and is used by several hacker groups. So how will Ryuk protect itself against ransomware?Ryuk uses a combination of AES symmetric encryption (256 bits) and RSA asymmetric encryption (2048 or 4096 bits) for his own deliberate moves. The symmetric key is used to encrypt the contents of the files, and the asymmetric public key is used to encrypt the symmetric key. After paying the ransom, the attackers provide the corresponding asymmetric private key that can be used to decrypt the files.Since Ryuk is used for targeted attacks, the primary infection vectors are selected based on the victim's data. These vectors are often targeted phishing emails, remote access to systems using stolen accounts, and the use of well-known mass malware. In the latter case, a combination of Emotet and TrickBot is often used to infect Ryuk; The use of BazarLoader has also recently been reported.Ryuk infections often come from spear phishing emails containing a malicious link or MS Office document. With their help, hackers can penetrate the victim's information environment. In some cases, computers with a compromised RDP protocol become such an access point.Spear phishing is a subtype of phishing that targets the most limited group of people (a company, a group of its employees, or an individual)The first scenario uses TrickBot or BazarLoader as the malware loader. As a result of its execution, other hackers can gain access to compromised machines. After that, computers are usually loaded with a Cobalt Strike beacon to steal usernames and passwords and move horizontally across the network to hijack domain controllers. As a result, the Ryuk binary is propagated to all machines through these controllers. How does this code work? Let's find out.Aggregate dataThe file being analyzed is a sample of an unpacked ransomware from the Ryuk family. This pattern can be identified using checksums (hashes).Hash typeValue SHA-11EFC175983A17BD6C562FE7B054045D6DCB341E5SHA-2568F368B029A3A5517CB133529274834585D087A2D3A 5875D03EA38E5774019C8AThe final payload of 30 April was compiledAnti-debuggingRyuk repeatedly uses decompilation protection techniques to make static analysis of program code difficult.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image1.jpg" alt="image1.jpg" class="fr-fic fr-dii fr-draggable " style="" />Disassembly protection technique How to protect yourself from Ryuk ransomwareDisassembly protection methodIn addition, the malicious code supports methods of protection against debugging using APIs ZwQueryInformationProcess and various functions (flags), such as [BProcessDebugFlags[/B], ProcessDebugPort and ProcessDebugObjectHandle. With their help, ransomware can detect the presence of a debugger and forcefully close it.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image2.jpg" alt="image2.jpg" class="fr-fic fr-dii fr-draggable " style="" />Request ProcessHow to Protect Against Ryuk Ransomware.Request processIn addition, the ransomware checks an attribute in the PEB structure of a process for the same purpose.BeingDebugged<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-006.jpg" alt="image-006.jpg" class="fr-fic fr-dii fr-draggable " style="" />Check for Process Debug Signs How to Protect Against Ryuk Ransomware.Controlling the symptoms of debugging a processPerformanceRyuk reproduces itself three times into the current folder with different names and runs these new binaries with different command line options. Each such execution maintains a separate fun-ktsiyu. The file name for the first copy of the malware is generated as a checksum of the current username, to which is appended r.exe.If the malware cannot get the username, the default name is used - When this file is run, the malware uses the command line. This process is responsible for Ryuk's self-replication on other machines on the network.rep.exe. 9 REP.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image3.jpg" alt="image3.jpg" class="fr-fic fr-dii fr-draggable " style="" />First Execution How to Protect Against Ryuk RansomwareFirst performanceThe name of the further copy of the Trojan is generated in a random manner and has the suffix lan.exe. This copy corresponds to command line 8 LAN. This process is responsible for sending Wake-On-Lan packets to other computers on the network.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-010.jpg" alt="image-010.jpg" class="fr-fic fr-dii fr-draggable " style="" />Second Execution How to Protect Against Ryuk Ransomware.Second executionThe name of the third copy is formed in the same way as the second, using the same command line.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image4.jpg" alt="image4.jpg" class="fr-fic fr-dii fr-draggable " style="" />Executing the third copy How to protect yourself from Ryuk ransomwareExecution of a third copyForeclosure NoticeTo inform the user that the files are encrypted, Ryuk uploads an HTML ransom message to each encrypted folder. This message is roughly the same for all Ryuk variants. The main difference in this example is the presence of a link button and instructions for installing the Tor browser.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-012.png" alt="image-012.png" class="fr-fic fr-dii fr-draggable " style="" />Ransom message in HTML format How to protect yourself from Ryuk ransomwareRansom notice in HTML formatWhen you click the Connect button, a pop-up window appears with instructions on how to contact the authors of the ransomware.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-016.png" alt="image-016.png" class="fr-fic fr-dii fr-draggable " style="" />Browser message with instructionsMessage with instructionsSpecified in the instructions the onion-lin-ka leads the user to a communication portal. There is a special form where you have to leave your email address, password, organization name and hacker message (in a separate field).<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image5.jpg" alt="image5.jpg" class="fr-fic fr-dii fr-draggable " style="" />How to protect yourself from Ryuk ransomware.Login to contact hackers using RyukDiversification of disk resolutionsThe Trojan recognizes mapped local drives using an API GetLogicalDrives call and uses the Windows icacls tool to change the permissions of each drive in order to gain full access to it.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-024.jpg" alt="image-024.jpg" class="fr-fic fr-dii fr-draggable " style="" />Executing the Icacls commandHere's an example of a command that Ryuk will execute:icacls "C:\*" /grant Everyone: F /T /C /QForce termination of processes and servicesBefore encrypting files, the Trojan creates a new thread to terminate a number of processes and stop some services.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image6.jpg" alt="image6.jpg" class="fr-fic fr-dii fr-draggable " style="" />Flow formationIn this new thread, Ryuk creates a list of running processes and services and compares it to a list of 41 processes and 64 services hardcoded into its code. Some of these processes and services are related to antivirus and backup tools, while others may use files encrypted as part of an attack.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image7.jpg" alt="image7.jpg" class="fr-fic fr-dii fr-draggable " style="" />Stream functionsThe encoder uses the following command to complete the process:Code:C:\Windows\System32\taskkill.exe /IM /FThe command to stop the services targeted by the ransomware:Code:C:\Windows\System32\net.exe stop /ySince such services as well as processes are checked by a function strstr that returns partial matches of strings, the malware also terminates other non-target processes, such as audioendpointbuilderbecause it contains a string of endpoints.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image8.jpg" alt="image8.jpg" class="fr-fic fr-dii fr-draggable " style="" />Force shutdown of a serviceFile encryptionThe Trojan tries to encrypt local and network drives by scanning all files on them and checking the path and name of each file. Ryuk does not encrypt files whose full paths include the following names:\Windows\WindowsbootWINDOWS\ChromeMozillaSYSVOLNTDSnetlogonsysvolThe malware also does not encrypt files with any of the following strings in their names:RyukReadMe.htmlbootdllntldrexe.ini.lnkbootmgrbootNTDETECTIn addition, Ryuk checks the filenames for the presence of the index. If present, the program will call the function RyukDropRansomNoteInIndexFile.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-026.png" alt="image-026.png" class="fr-fic fr-dii fr-draggable " style="" />Tracking files with the string index in the nameIf the file has an extension .php, the ransomware will generate PHP code to create an HTML ransom message. Otherwise, it will overwrite the contents of the file using the HTML code of the ransom claim message. Thus, when trying to access the site, the user will see Ryuk's message with the demands of the cybercriminals.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-028.png" alt="image-028.png" class="fr-fic fr-dii fr-draggable " style="" />Embedding Ryuk ransom notification text into files named indexThis feature is believed to have been added in newer versions of malware to attack web servers and hack public websites, replacing their home pages with ransom messages from Ryuk. This tactic has never been used in ransomware before, the ultimate goal of which is to force the victim to pay a ransom.The coding technique in the latest version of Ryuk is the same as before. For each file, the program uses random AES-256 keys generated using the API and then encrypts these keys using the RSA public key embedded in the malicious code. With this scheme, cybercriminals guarantee secure encryption as well as reliable key management.CryptGenKey<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-034.png" alt="image-034.png" class="fr-fic fr-dii fr-draggable " style="" />AES-256 key generationOn the eve of processing a file, the Trojan checks whether the file has already been encrypted. To do this, a keyword search is carried out: for old versions of Ryuk and for new ones. If such keywords are found, the file will not be used and will not be encrypted.HERMES RYUKTM<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image9.jpg" alt="image9.jpg" class="fr-fic fr-dii fr-draggable " style="" />Checking HERMES and RYUKTMAfter that, the Trojan starts encrypting the file in portions of the specified size - 1,000,000 bytes each.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image10.jpg" alt="image10.jpg" class="fr-fic fr-dii fr-draggable " style="" />File encoding by componentsNext Ryuk adds a keyword RYUKTM, with the aim to mark the file as an encrypted, exports AES key that encrypted public RSA key with the support of the API CryptExportKey, and attaches it to the end of the file.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-036.png" alt="image-036.png" class="fr-fic fr-dii fr-draggable " style="" />File Key ExportBelow is an example of an encrypted file with 274 bytes of metadata appended by Ryuk to the end of the file.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-040.jpg" alt="image-040.jpg" class="fr-fic fr-dii fr-draggable " style="" />Attached metadataPrint jobAfter encrypting the files, Ryuk creates a new scheduled job to print 50 copies of the ransom message in RTF format on the system default printer. The command line for creating such a job looks like this:SCHTASKS /CREATE /NP /SC DAILY /TN "PrintvE" /TR "C:\Windows\System32\cmd. exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\YTKkI. dll" /ST 10:25 /SD 05/18/2021 /ED 05/25/2021The task will be completed at the prescribed time throughout the week. The printed 50-page ransom message in RTF format will contain a password that is uploaded to the public directory as a file with a random name and extension .dll.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image11.jpg" alt="image11.jpg" class="fr-fic fr-dii fr-draggable " style="" />Ryuk Ransom RTF NoticeThis feature is also new. It was added to the architecture of the Trojan in order to harm the victim's system and force him to pay a ransom for decrypting files.Remote network connectionThe Ryuk 8 LAN command line process is designed to get system ARP caches and send Wake on Lan packets to power remote computers. To download the ARP table, the malware uses the API GetIpNetTable from the file. iphlpapi.dll. Having received the specified table, the ransomware starts sending packets using the API from the Winsock library.sendto<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-042.png" alt="image-042.png" class="fr-fic fr-dii fr-draggable " style="" />Sending a Wake on Lan packetWake on Lan Magic packets are 6 bytes long with a value of 255 (hex 0xFF) followed by the destination MAC address written 16 times. The total packet size is 102 bytes.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-044.png" alt="image-044.png" class="fr-fic fr-dii fr-draggable " style="" />Wake on Lan packageSequential enumeration of shared network foldersRyuk also seeks to migrate horizontally to other hosts on the network. For this, the program predetermines all P-addresses assigned to the system and checks if they belong to the private IPv4 address range (10.xxx, 172.16.xx and 192.168.xx). Because this check is done using a function strstr, you can find matches with other public subnets such as 151.192.172.1.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image12.jpg" alt="image12.jpg" class="fr-fic fr-dii fr-draggable " style="" />Error control of private IP networksIf one of the above subnets is found, the ransomware will start sending ICMP Echo requests using the API to discover new computers on that subnet. If the computer responds to the request, it will be considered a potential victim and Ryuk will try to encrypt the files on it.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image13.jpg" alt="image13.jpg" class="fr-fic fr-dii fr-draggable " style="" />ICMP Echo RequestRyuk will attempt to encode files on any host it finds, similar to how it is used for local drives. The ransomware creates a UNC path for all drive letters (A to Z) in the format Then the Trojan will attempt to gain access and encrypt along the way. This attempt is shown in the following figure.\\<IP>\<drive letter>$.\\<IP>.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-052.png" alt="image-052.png" class="fr-fic fr-dii fr-draggable " style="" />Encrypting files over UNCServer message block (SMB) replicationThe Ryuk 9 REP command line process is responsible for replicating malware to new computers, while checking to see if the process is running twice. To do this, a mutex object is created with a name similar to the username of the machine. If the mutex is already present, the procedure will be stopped.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-054.png" alt="image-054.png" class="fr-fic fr-dii fr-draggable " style="" />Creating a mutexIn the next step, Ryuk monitors the presence of its own files on the remote computer using the API GetFileAttributesW. The UNC file path is created in parallel; Then the program will try to access the folder C: \ Users \ Public on the remote computer. The file is created with a name that is the checksum of the current username with the added suffix r.exe.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image-024.jpg" alt="image-024.jpg" class="fr-fic fr-dii fr-draggable " style="" />Copying the Ryuk fileThe ransomware then uses the API CopyFileW to copy the file to the remote computer. To ensure that this copy is executed remotely, the malware will create a scheduled task with a random name using the utility schtasks.exe.<img src="https://cryptoworld.su/wp-content/uploads/2021/08/image14.jpg" alt="image14.jpg" class="fr-fic fr-dii fr-draggable " style="" />Creating a remote serviceThus, for each compromised remote machine, two commands are executed:Code:schtasks.exe /Create /S 192.168.56.2 /TN qdpRGwh /TR "C:\\Users\\Pub- lic\\622r.exe" /sc once /st 00:00 /RL HIGHESTschtasks.exe /S 192.168.56.2 /Run /TN qdpRGwhConclusionThis concise report shows a technical description of the Ryuk ransomware and the latest features that have been integrated into its code in order to increase the damage to organizations falling into the victim category.Interestingly, Ryuk's attention has shifted to web servers, as instead of encrypting the index files in the web server folders, the software replaces them with a ransom message. In addition, the Ryuk developers have added the ability to print a malware ransom message on the default printer.In the first half of the year, a number of hacker groups that exploit Ryuk vigorously campaigned and attacked offices around the planet. This is why cybercriminals using Ryuk will resume developing new features and ways of doing things to maximize their value.</blockquote>

Name

Verification