A new ransomware named Nemty has appeared online, which is believed to be a successor to GrandCrab or Buran. The malware is primarily spread through a counterfeit PayPal site and has several interesting features. Details on how this ransomware operates are below.
New ransomware Nemty discovered by user September 7, 2019. The malware was distributed via a site , and there is also a possibility of ransomware infiltrating computers via the RIG exploit kit. The attackers used social engineering methods to trick users into running the cashback.exe file, which they supposedly received from the PayPal site. Interestingly, Nemty specifies an incorrect port for the local Tor proxy service, preventing the malware from sending data to the server. Therefore, users will have to upload encrypted files to the Tor network themselves if they intend to pay the ransom and await decryption from the attackers.
Several intriguing facts about Nemty suggest that it was developed by the same people or associated cybercriminals as Buran and GrandCrab.
- Like GandCrab, Nemty includes an Easter egg — a link to a photo of Russian President Vladimir Putin with a vulgar joke. The outdated GandCrab ransomware had an image with the same text.
- Language artifacts from both programs indicate the same Russian-speaking authors.
- This is the first ransomware to use a 8092-bit RSA key. Although there is no real need for it: a 1024-bit key is sufficient to protect against decryption.
- Like Buran, the ransomware is written in Object Pascal and compiled in Borland Delphi.
Static analysis
The execution of the malicious code occurs in four stages. The first step is to launch cashback.exe, a PE32 executable file for MS Windows, with a size of 1198936 bytes. Its code is written in Visual C++ and compiled on October 14, 2013. It contains an archive that automatically unpacks upon launching cashback.exe. The software uses the Cabinet.dll library and its functions FDICreate(), FDIDestroy(), and others to retrieve files from the .cab archive.
SHA-256: A127323192ABED93AED53648D03CA84DE3B5B006B641033EB46A520B7A3C16FC
After unpacking the archive, three files will appear.
Then temp.exe is launched, a PE32 executable file for MS Windows with a size of 307200 bytes. The code is written in Visual C++ and packed using the MPRESS packer, a packer similar to UPX.
SHA-256: EBDBA4B1D1DE65A1C6B14012B674E7FA7F8C5F5A8A5A2A9C3C338F02DD726AAD
The next step is ironman.exe. After launching, temp.exe decrypts the embedded data into temp and renames it to ironman.exe, a PE32 executable file sized 544768 bytes. The code is compiled in Borland Delphi.
SHA-256: 2C41B93ADD9AC5080A12BF93966470F8AB3BDE003001492A10F63758867F2A88
The final step is to restart the file ironman.exe. During execution, it transforms its code and runs itself from memory. This version of ironman.exe is malicious and responsible for encryption.
Attack vector
Currently, the Nemty ransomware is distributed through the website pp-back.info.
The full infection chain can be viewed at sandbox.
Installation
Cashback.exe is the beginning of the attack. As mentioned earlier, cashback.exe unpacks the .cab file contained within it. Then it creates a folder named TMP4351$.TMP at %TEMP%IXxxx.TMP, where xxx is a number from 001 to 999.
Next, a registry key is set up that looks like this:
[HKLMSOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionRunOncewextract_cleanup0]
“rundll32.exe” “C:Windowssystem32advpack.dll,DelNodeRunDLL32 «C:UsersMALWAR~1AppDataLocalTempIXPxxx.TMP»”
It is used to delete unpacked files. Finally, cashback.exe launches the process temp.exe.
Temp.exe is the second stage in the infection chain.
This is the process initiated by the cashback.exe file, the second step of the virus execution. It attempts to download AutoHotKey — a tool for running scripts on Windows — and execute the resource script WindowSpy.ahk located in the PE file.
The script WindowSpy.ahk decrypts the temp file into ironman.exe using the RC4 algorithm and the password IwantAcake. The key from the password is derived using the MD5 hashing algorithm.
Then, temp.exe invokes the process ironman.exe.
Ironman.exe is the third step.
Ironman.exe reads the contents of the file iron.bmp and creates a file iron.txt with the cryptolocker that will run next.
After that, the virus loads iron.txt into memory and restarts it as ironman.exe. After this, iron.txt is deleted.
Ironman.exe is the main part of the NEMTY ransomware, which encrypts files on the infected computer. The malware creates a mutex called hate.
First, it determines the geographical location of the computer. Nemty opens the browser and identifies the IP at . On the website [IP]/countryName based on the retrieved IP determines the country, and if the computer is located in one of the regions listed below, the execution of the malware code stops:
- Russia
- Belarus
- Ukraine
- Kazakhstan
- Tajikistan
Most likely, the developers do not want to attract the attention of law enforcement agencies in their countries of residence, and therefore do not encrypt files in their 'native' jurisdictions.
If the victim's IP address is not on the above list, the virus encrypts the user's information.
To prevent file recovery, their shadow copies are deleted:
Then, a list of files and folders that will not be encrypted is created, as well as a list of file extensions.
- windows
- $RECYCLE.BIN
- rsa
- NTDETECT.COM
- ntldr
- MSDOS.SYS
- IO.SYS
- boot.ini AUTOEXEC.BAT ntuser.dat
- desktop.ini
- CONFIG.SYS
- BOOTSECT.BAK
- bootmgr
- programdata
- appdata
- osoft
- Common Files
log LOG CAB cab CMD cmd COM com cpl
CPL exe EXE ini INI dll DDL lnk LNK url
URL ttf TTF DECRYPT.txt NEMTY Obfuscation
To hide URLs and embedded configuration data, Nemty uses Base64 and RC4 encoding with the key phrase fuckav.
The decryption process using CryptStringToBinary looks as follows
Encryption
Nemty uses triple encryption:
- AES-128-CBC for files. A 128-bit AES key is randomly generated and used the same for all files. It is stored in the configuration file on the user's computer. IV is randomly generated for each file and stored in an encrypted file.
- RSA-2048 for encrypting the file IVs. A key pair for the session is generated. The session's private key is stored in the configuration file on the user's computer.
- RSA-8192. The main public key is embedded in the program and is used to encrypt the configuration file that stores the AES key and the secret key for the RSA-2048 session.
- First, Nemty generates 32 bytes of random data. The first 16 bytes are used as the AES-128-CBC key.
The second encryption algorithm is RSA-2048. The key pair is generated using the CryptGenKey() function and imported using the CryptImportKey() function.
After the key pair for the session is generated, the public key is imported into the MS Cryptographic Service Provider.
Example of the generated public key for the session:
Next, the private key is imported into the CSP.
Example of the generated private key for the session:
And finally, RSA-8192 comes last. The main public key is stored in encrypted form (Base64 + RC4) in the .data section of the PE file.
The RSA-8192 key after base64 decoding and RC4 decryption with the password fuckav looks like this.
As a result, the entire encryption process looks as follows:
- Generating a 128-bit AES key that will be used for encrypting all files.
- Creating an IV for each file.
- Generating a key pair for the RSA-2048 session.
- Decrypting the existing RSA-8192 key using base64 and RC4.
- Encrypting the contents of files using the AES-128-CBC algorithm from the first step.
- Encrypting the IV with the RSA-2048 public key and encoding it in base64.
- Appending the encrypted IV to the end of each encrypted file.
- Adding the AES key and the private key of the RSA-2048 session to the config.
- Configuration data described in the section about the infected computer is encrypted with the main RSA-8192 public key.
- The encrypted file looks as follows:
Example of encrypted files:
Collecting information about the infected computer
The ransomware collects keys for decrypting infected files, allowing the attacker to create a decryptor. Additionally, Nemty gathers user data such as username, computer name, and hardware profile.
It calls the functions GetLogicalDrives(), GetFreeSpace(), GetDriveType() to gather disk information from the infected computer.
The collected information is stored in a configuration file. By decoding the string, we obtain a list of parameters in the configuration file:
Example of the configuration of the infected computer:
The configuration template can be represented as follows:
{"General": {"IP":"[IP]","Country":"[Country]","ComputerName":"[ComputerName]","Username":"[Username]","OS":"[OS]","isRU":false,"version":"1.4","CompID":"{[CompID]}","FileID":"_NEMTY_[FileID]_","UserID":"[UserID]","key":"[key]","pr_key":"[pr_key]
The collected data is stored by Nemty in JSON format in the file %USER%/_NEMTY_.nemty. The FileID, composed of 7 characters, is generated randomly. For example: _NEMTY_tgdLYrd_.nemty. The FileID is also appended to the end of the encrypted file.
Ransom message
After encrypting the files, a file _NEMTY_[FileID]-DECRYPT.txt appears on the desktop with the following content:
At the end of the file, there is encrypted information about the infected computer.
Network communication
The process ironman.exe downloads the Tor browser distribution from the address and attempts to install it.
Then Nemty attempts to send configuration data to the address 127.0.0.1:9050, where it expects to find a working Tor browser proxy server. However, by default, the Tor proxy server listens on port 9150, while port 9050 is used by the Tor daemon in Linux or the Expert Bundle on Windows. Thus, data is not sent to the attacker’s server. Instead, the user can manually download the configuration file by visiting the Tor decryption service through the link provided in the ransom note.
Connecting to Tor proxy:
HTTP GET creates a request to 127.0.0.1:9050/public/gate?data=
Here you can see the open TCP ports used by the TORlocal proxy:
Nemty decryption service in the Tor network:
You can upload an encrypted photo (jpg, png, bmp) to test the decryption service.
After that, the attacker demands a ransom. In case of non-payment, the price doubles.
Conclusion
Currently, it is impossible to decrypt files encrypted by Nemty without paying the ransom. This version of ransomware shares common traits with the Buran and outdated GandCrab encryptors: compiled with Borland Delphi and images containing the same text. Furthermore, it is the first encryptor to utilize a 8092-bit RSA key, which, again, makes no sense as a 1024-bit key is sufficient for protection. Interestingly, it attempts to use an incorrect port for the local Tor proxy service.
Nevertheless, solutions and prevent the Nemty encryptor from accessing user PCs and data, and providers can protect their clients with . Comprehensive not only provides backups but also protection using , a specialized technology based on artificial intelligence and behavioral heuristics that can neutralize even previously unknown malware.
Source: habr.com
