Sometimes you just want to look into the eyes of a virus writer and ask: why and how? We can handle the question of "how" ourselves, but it would be fascinating to know what that particular creator of malware was thinking. Especially when we come across such "gems."
The hero of today's article is an interesting specimen of ransomware. It appears to have been conceived as yet another "extortionist," but its technical implementation resembles some kind of cruel joke. We will talk about this implementation today.
Unfortunately, tracking the lifecycle of this encoder is virtually impossible – there is very little statistics on it, as fortunately, it has not gained widespread distribution. So, we will leave aside its origin, infection methods, and other mentions. We will only share our case of encountering Wulfric Ransomware and how we helped the user recover their files.
I. How It All Started
Our antivirus lab often receives inquiries from people who have been affected by ransomware. We provide assistance regardless of the antivirus products they have installed. This time, a person reached out to us whose files were infected by an unknown encoder.
Good afternoon! Files were encrypted on a file storage (samba4) with passwordless login. I suspect the infection came from my daughter’s computer (Windows 10 with the built-in Windows Defender protection). The daughter’s computer has not been turned on since then. Files encrypted mainly include .jpg and .cr2 formats. The file extension after encryption is: .aef.
We received samples of the encrypted files from the user, a ransom note, and a file that is likely the key required by the ransomware author to decrypt the files.
Here are all our clues:
- 01c.aef (4481K)
- hacked.jpg (254K)
- hacked.txt (0K)
- 04c.aef (6540K)
- pass.key (0K)
Let's take a look at the note. How many bitcoins this time?
Translation:
Attention, your files are encrypted!
the password is unique to your PC.Pay the amount of 0.05 BTC to the bitcoin address: 1ERtRjWAKyG2Edm9nKLLCzd8p1CjjdTiF
After payment, send me an email attaching the pass.key file to Wulfric@gmx.com with a payment notification.Upon confirmation, I will send you the decryptor for your files.
You can pay bitcoins online in various ways:
— credit card payment
About bitcoins:
If you have any questions, feel free to email me at Wulfric@gmx.com
As a bonus, I will explain how your computer was hacked and how to protect it in the future.
A dramatic wolf, summoned to show the victim the seriousness of the situation. Still, it could have been worse.
Fig. 1. -As a bonus, I will tell you how to protect your computer in the future. –Seems legit.
II. Let's get to work
First, we looked at the structure of the sample sent. Strangely enough, it did not resemble a file affected by ransomware. We opened a hex editor to take a look. The first 4 bytes contain the original file size, the following 60 bytes are filled with zeros. But the most interesting part is at the end:
Fig. 2. Analyzing the corrupted file. What stands out immediately?
It turned out to be infuriatingly simple: 0x40 bytes from the header were moved to the end of the file. To recover the data, it is enough to just return them to the beginning. Access to the file has been restored, but the name remains encrypted, which is more complicated.
Fig. 3. The encrypted name in Base64 looks like a random string of characters.
Let’s try to decode it pass.key, sent by the user. In it, we see a 162-byte sequence of characters in ASCII.
Fig. 4. 162 characters left on the victim's PC.
If you look closely, you can see that the characters repeat with a certain periodicity. This may indicate the use of XOR, where repetitions are characteristic, and the frequency depends on the key length. Splitting the string into 6-character segments and XORing with some variations of XOR sequences did not yield any meaningful results.
Fig. 5. Do you see the repeating constants in the middle?
We decided to Google the constants, because yes, that’s also an option! And they all eventually led to one algorithm − Batch Encryption. After studying the script, it became clear that our string is nothing more than the result of its work. It should be noted that this is not ransomware at all, but simply an encoder that replaces characters with 6-byte sequences. No keys or other secrets 🙁
Fig. 6. A piece of the original algorithm of unknown authorship.
The algorithm would not have worked as intended if it weren't for one detail:
Fig. 7. Morpheus approved.
Using reverse substitution, we convert the string from pass.key in the text of 27 characters. Special attention deserves the human (most likely) text ‘asmodat’.
Fig. 8. USGFDG=7.
Google will help us again. After a brief search, we find an interesting project on GitHub – Folder Locker, written in .Net and using the ‘asmodat’ library from another account on Git.
Fig. 9. The Folder Locker interface. We definitely checked for malware.
The utility is an encryptor for Windows 7 and later, distributed as open source. It uses a password for encryption, which is required for subsequent decryption. It can work with both individual files and entire directories.
Its library uses the Rijndael symmetric encryption algorithm in CBC mode. Notably, the block size has been chosen to be 256 bits – unlike the 128-bit limit specified in the AES standard.
Our key is formed according to the PBKDF2 standard. The password used is the SHA-256 of the string entered in the utility. We just need to find this string to form the decryption key.
Well, let’s return to our already decoded pass.key. Remember that line with a set of digits and the text ‘asmodat’? Let's try using the first 20 bytes of the string as a password for Folder Locker.
Look at that, it works! The passphrase was correct, and everything decrypted perfectly. Judging by the password characters, it is a HEX representation of a specific word in ASCII. Let's try to display the passphrase in text form. We get ‘shadowwolf’. Already feeling symptoms of lycanthropy?
Let's take another look at the structure of the affected file, now that we know how the locker works:
- 02 00 00 00 – name encryption mode;
- 58 00 00 00 – length of the encrypted and base64 encoded file name;
- 40 00 00 00 – size of the transferred header.
Highlighted in red and yellow are the encrypted name and the transferred header, respectively.
Fig. 10. The encrypted name is highlighted in red, and the transferred header is highlighted in yellow.
Now let's compare the encrypted and decrypted names in hexadecimal representation.
Structure of the decrypted data:
- 78 B9 B8 2E – garbage created by the utility (4 bytes);
- 0C 00 00 00 – length of the decrypted name (12 bytes);
- then comes the actual file name and padding with zeros to the required block length.
Fig. 11. IMG_4114 looks much better.
III. Conclusions and Summary
Returning to the beginning. We do not know what motivated the author of Wulfric.Ransomware or what goal he pursued. Undoubtedly, for the average user, the result of even such a ransomware's work will seem like a major disaster. Files cannot be opened. All names are gone. Instead of the familiar image, there is a wolf on the screen. They force users to read about bitcoins.
However, this time, behind the guise of a 'fearsome encoder' was such a ridiculous and senseless attempt at extortion, where the perpetrator uses ready-made programs and leaves the keys right at the crime scene.
By the way, about the keys. We did not have a malicious script or trojan that would allow us to understand how this pass.key – the mechanism of file appearance on the infected PC remains unknown. However, I remember that in his note, the author mentioned the uniqueness of the password. So, the code word for decryption is as unique as the username shadow wolf 🙂
And still, shadow wolf, why and for what purpose?
Source: habr.com
