• Tag Archives IT Security
  • New Spam Campaign Distributes Locky Ransomware and Kovter Trojan Combined

    Criminals have taken a liking to the idea of combining multiple types of malware into one distribution campaign. Malware Protection Center researchers discovered a string of email messages using malicious attachments to spread both Locky ransomware and the Kovter Trojan. It is not the first time these two types of malware are distributed in the same campaign, as dual-pronged spam campaigns have become more common as of late.

    This morning we noticed the start of a campaign using  New notice to Appear in Court as the email subject. The attachments are identical to the Typical .JS, .WSF, .lnk file inside a double zip. All the sites seen so far today are the same sites used in the USPS, FedEx, UPS current campaigns.  I am sure that both campaigns will continue side by side. It is very likely that different “affiliates” are using the same distribution network, but each one prefers a different email lure to gain victims.

    The attachments all start with a zip named along the lines of Notice_00790613.zip which contain another zip Notice_00790613.doc.zip which in turn contains Notice_00790613.doc.js

    Criminals Step Up Malware Distribution

    It is rather disconcerting to learn opening a malicious email attachment can introduce two different types of malware at the same time. As if the Locky ransomware is not annoying to deal with on its own, computer users will also be affected by the Kovter Trojan. This latter piece of malware specialized in click fraud, generating a lot of illegal advertisement revenue for criminals.

    Through a malicious email attachment, criminals execute a script that contains links to multiple domains where the malware types are downloaded from. By making the attachment a .Ink file, the recipient may click it and have the payload download executed in the background. PowerShell scripts have become a fan favorite among criminals targeting Windows users these days, that much is certain.

    Researchers discovered a total of five hardcoded domains in the script from where the malware can be downloaded. Both the Locky ransomware and Kovter Trojan payloads are hosted on these platforms, and it is expected more of these domains will continue to pop up over time. Although law enforcement agencies can take down these domains rather easily, criminals will not hesitate to create additional hosting solutions over time.

    As one would expect from these spam email campaigns, the message in question is a fake receipt for a spoofed USPS delivery email. In the attached zip file, there is the malicious .Ink file , which initiates the PowerShell script once opened. One interesting aspect about this script is how it checks if the file is downloaded successfully and if is at least 10KB in size. Once that has been verified, it will stop the process automatically.

    Microsoft researchers feel the use of multiple domain names to download the payload from is a powerful obfuscation technique. Blacklisting one specific URL is a lot easier than dealing with a handful of different domains. Moreover, this method seems to hint at how criminals can easily add more servers to download the malicious payloads from if they want to. A very troublesome development, to say the least.

    Perhaps the most worrisome aspect of this new malware distribution campaign is how criminals continue to update the payloads themselves. Both Kovter and Locky receive regular updates, which means the development of ransomware and click-fraud Trojans is still going on behind the scenes. Moreover, it goes to show criminals will continue to rely on multi-pronged distribution campaigns for malware and ransomware moving forward.


  • Ransomeware Decrypters Available Decryption Service – Decryptor Download Decrypt Files

    New version of ODCODCDecoder Released Download Decrypter

    BloodDolly has released a new version of his ODCODC Ransomwaredecryptor. The decryptor can be downloaded from.

    Emsisoft Decrypter for Marlboro Download Decrypter

    The Marlboro ransomware was first seen on January 11th, 2017. It is written in C++ and uses a simple XOR-based encryption algorithm. Encrypted files are renamed to “.oops”. The ransom note is stored inside a file named “_HELP_Recover_Files_.html” and includes no further point of contact.

    Due to a bug in the malware’s code, the malware will truncate up to the last 7 bytes from files it encrypts. It is, unfortunately, impossible for the decrypter to reconstruct these bytes.

    To use the decrypter, you will require an encrypted file of at least 640 bytes in size as well as its unencrypted version. To start the decrypter select both the encrypted and unencrypted file and drag and drop them onto the decrypter executable.

    Decryptor released for the Merry Christmas or Merry X-Mas Ransomware Download Decrypter

    Fabian Wosar has done it again and released a decryptor for the files encrypted by the Merry Christmas or Merry X-Mas Ransomware. These files will have the extensions .PEGS1, .MRCR1, .RARE1, .RMCM1 appended to them.

    Crypt38Decrypter Download Download Decrypter

    BitStakDecrypter Download Download Decrypter

    lphaDecrypter Download Download Decrypte

    Unlock92Decrypter Download Download Decrypter

    Hidden Tear Decrypter Download Download Decrypter

    Hidden Tear BruteForcer Download Download Decrypter

    PowerLockyDecrypter Download Download Decrypter

    GhostCryptDecrypter Download Download Decrypter

    MicroCop Decryptor Download Download Decrypter

    Jigsaw Decrypter Download Download Decrypter

    Rannoh Decryptor (updated 20-12-2016 with CryptXXX v3) Download Decrypter

    RannohDecryptor tool is designed to decrypt files encrypted by:

    • CryptXXX versions 1, 2 and 3.
    • Marsjoke aka Polyglot;
    • Rannoh;
    • AutoIt;
    • Fury;
    • Crybola;
    • Cryakl;

    Globe3 Decryptor Download Decrypter
    The tool is designed to decrypt files encrypted by Globe3 Ransomware.

    Derialock Decryptor Download Decrypter
    Derialock decryptor tool is designed to decrypt files encrypted by Derialock

    PHP Ransomware Decryptor Download Decrypter
    PHP ransomware decryptor tool is designed to decrypt files encrypted by PHP ransomware

    WildFire Decryptor Download Decrypter
    WildfireDecryptor tool is designed to decrypt files encrypted by Wildfire

    Chimera Decryptor Download Decrypter
    ChimeraDecryptor tool is designed to decrypt files encrypted by Chimera

    Teslacrypt Decryptor Download Decrypter
    TeslaDecryptor can decrypt files encrypted by TeslaCrypt v3 and v4

    Shade Decryptor Download Decrypter
    ShadeDecryptor can decrypt files with the following extensions: .xtbl, .ytbl, .breaking_bad, .heisenberg.

    CoinVault Decryptor Download Decrypter

    The CoinVault decryption tool decrypts files encrypted by Coinvault and Bitcryptor.

    Rakhni Decryptor (updated 14-11-2016) Download Decrypter

    RakhniDecryptor tool is designed to decrypt files encrypted by:

    • Crysis;
    • Chimera;
    • Rakhni;
    • Agent.iih;
    • Aura;
    • Autoit;
    • Pletor;
    • Rotor;
    • Lamer;
    • Lortok;
    • Cryptokluchen;
    • Democry;
    • Bitman (TeslaCrypt) version 3 and 4.

    Trend Micro Ransomware File Decryptor Download Decrypter

    Supported Ransomware Families

    The following list describes the known ransomware-encrypted files types can be handled by the latest version of

    the tool.

    Ransomware

    File name and extension

    CryptXXX V1, V2, V3*

    {original file name}.crypt, cryp1, crypz, or 5 hexadecimal characters

    CryptXXX V4, V5

    {MD5 Hash}.5 hexadecimal characters

    Crysis

    .{id}.{email address}.xtbl, crypt

    TeslaCrypt V1**

    {original file name}.ECC

    TeslaCrypt V2**

    {original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZ

    TeslaCrypt V3

    {original file name}.XXX or TTT or MP3 or MICRO

    TeslaCrypt V4

    File name and extension are unchanged

    Rating:

    485 found this helpful

    Category:

    Troubleshoot

    Solution Id:

    1114221

    13/12/2016, 22)42

    Using the Trend Micro Ransomware File Decryptor Tool

    Page 2 of 6

    https://success.trendmicro.com/solution/1114221#

    #

    TeslaCrypt V4

    File name and extension are unchanged

    SNSLocker

    {Original file name}.RSNSLocked

    AutoLocky

    {Original file name}.locky

    BadBlock

    {Original file name}

    777

    {Original file name}.777

    XORIST

    {Original file name}.xorist or random extension

    XORBAT

    {Original file name}.crypted

    CERBER V1

    {10 random characters}.cerber

    Stampado

    {Original file name}.locked

    Nemucod

    {Original file name}.crypted

    Chimera

    {Original file name}.crypt

    LECHIFFRE

    {Original file name}.LeChiffre

    MirCop

    Lock.{Original file name}

    Jigsaw

    {Original file name}.random extension

    Globe/Purge

    V1: {Original file name}.purge

    V2: {Original file name}.{email address + random characters}

    V3: Extension not fixed or file name encrypted

    DXXD

    V1: {Original file name}.{Original extension}dxxd

    Teamxrat/Xpan

    V2: {Original filename}.__xratteamLucked

    Crysis

    .{id}.{email address}.xtbl, crypt

    NMoreira Decryptor download
    The tool is designed to decrypt files encrypted by NMoreira Ransomware.

    Ozozalocker Decryptor download
    The tool is designed to decrypt files encrypted by Ozozalocker Ransomware.

    Globe Decryptor download
    The tool is designed to decrypt files encrypted by Globe Ransomware.

    Globe2 Decryptor download
    The tool is designed to decrypt files encrypted by Globe2 Ransomware.

    FenixLocker Decryptor download
    The tool is designed to decrypt files encrypted by FenixLocker Ransomware.

    Philadelphia Decryptor download
    The tool is designed to decrypt files encrypted by Philadelphia Ransomware.

    Stampado Decryptor download
    The tool is designed to decrypt files encrypted by Stampado Ransomware.

    Xorist Decryptor download
    The tool is designed to decrypt files encrypted by Xorist Ransomware.

    Nemucod Decryptor download
    The tool is designed to decrypt files encrypted by Nemucod Ransomware.

    Gomasom Decryptor download
    The tool is designed to decrypt files encrypted by Gomasom Ransomware.

    Linux.Encoder Decryptor download

    Decryption tools have been designed for infections of the Linux.Encoder.1 and Linux.Encoder.3 ransomware

     


  • Windows 10 Surveillance Platform weaponized into and back ported Implants delivered seamlessly to Windows 7 and 8 via Windows Update

    Windows 10 Surveillance Platform weaponized into and back ported Implants delivered seamlessly to Windows 7 and 8 via Windows Update

    You may or may not have noticed shenanigans in your windows based 7 and * machines.

    Microsoft likes the data they stream from windows 10 machines soo much that they decided to back port functionaly and carve out impants resulting in a of push 4 optional and 2 important windows updates

    They will appear in control panel installed updates as

    Optional
    “Update for Microsoft Windows (KB3068708)”
    “Update for Microsoft Windows (KB3075249)”
    “Update for Microsoft Windows (KB3080149)”
    “Update for Microsoft Windows (KB3022345)”

    Important
    “Update for Microsoft Windows (KB2952664)”
    “Update for Microsoft Windows (KB3021917)”

    If you have better things to do than hand eye troll through the list of installed updates then here are two approached to detect the SurveillanceWare Implants.

    The referenced KB’s are specific to the surveillance implants which target Windows 7 only. If your running windows 8, 8.1 or 10 your more than likely fighting much more of a loosing battle. So this section is specific so where it may be temporarily possible to remove the Implants.

    Detection – Open an elevated command prompt
    wmic QFE list full /format:texttablewsys | find “KB3068708”
    wmic QFE list full /format:texttablewsys | find “KB3022345”
    wmic QFE list full /format:texttablewsys | find “KB3075249”
    wmic QFE list full /format:texttablewsys | find “KB3080149”
    wmic QFE list full /format:texttablewsys | find “KB3021917”
    wmic QFE list full /format:texttablewsys | find “KB2952664”

    or alternatively detect with an update to the systeminfo command

    systeminfo | findstr “KB3068708 KB3022345 KB3075249 KB3080149 KB3021917 KB2952664”

    To start removal after optionally taking an evidence image or a system backup
    wusa /uninstall /kb:3068708 /quiet /norestart
    wusa /uninstall /kb:3022345 /quiet /norestart

    Then reboot seems required then continue
    wusa /uninstall /kb:3075249 /quiet /norestart
    wusa /uninstall /kb:3080149 /quiet /norestart
    wusa /uninstall /kb:3021917 /quiet /norestart
    wusa /uninstall /kb:2952664 /quiet /norestart

    ———- Windows 7, 8, 8.1 script to detect implants——-
    Here is a list and updated DIY detection ready scripting for all 14 (currently known) Surveillance implants. Including Implants for windows 8 and later.

    I guess they thought they could catch more fish with 14 baited lines.

    Here are two batch files . run the larger script to see whats detected.

    Open an elevated command prompt

    create a batch file
    Name: check-kb.bat

    Add the batch script content

    @echo off
    echo ‘ Only the first parameter is used in the search, the rest display context.
    echo ‘
    echo ‘
    echo Checking for %1 %2 %3 %4 %5 %6 %7 %8 %9 %10
    @echo on
    wmic QFE list full /format:texttablewsys | find “%1”
    @echo off

    Create a batch file, purpose is to check for currently known Implants.
    Name: checkfor_NPI_patches.bat

    Add the batch script content

    @echo off
    SetLocal
    REM — (as of 2015-08-26):
    cls
    call Check-kb KB3012973 – Opt in payload – Upgrade to Windows 10 Pro
    call Check-kb KB3021917 – Opt in payload – Update to benchmark Windows 7 SP1
    call Check-kb KB3035583 – Opt in payload – delivers reminder “Get Windows 10” for Windows 8.1 and Windows 7 SP1
    call Check-kb KB2952664 – Opt in payload – Pre launch day push of payload for compatibility update for upgrading Windows 7
    call Check-kb KB2976978 – Opt in payload – Pre launch day push of payload for Compatibility update for Windows 8.1 and Windows 8
    call Check-kb KB3022345 – Opt in payload – surveillance Telemetry [Replaced by KB3068708]
    call Check-kb KB3068708 – Opt in payload – Update for surveillance customer experience and diagnostic telemetry
    call Check-kb KB2990214 – Opt in payload – Update that prepares payload to Windows 7 to add surveillance in later installed versions of Windows
    call Check-kb KB3075249 – Opt in payload – Update that adds surveillance telemetry to Windows 8.1 and Windows 7
    call Check-kb KB3080149 – Opt in payload – Update for CIP and surveillance with diagnostic exfil leveraging telemetry
    call Check-kb KB3044374 – Opt in payload – Marketing Windows 10 surveillance payload to windows 8,8.1 devices
    call Check-kb KB2977759 – Opt in payload – Windows 10 surveillance Diagnostics Compatibility Telemetry HTTP request response
    call Check-kb KB3050265 – Opt in payload – Marking via Windows Update services opting in to Windows 10 surveillance Implant
    call Check-kb KB3068707 – Opt in payload – CIP telemetry request response check in for Windows 7,8,8.1

    Whatever Surveillance implants revealed in your machine, it can be removed with a customization of the wusa command, just replace the ??????? with the kb numbers reported.

    wusa /uninstall /kb:??????? /quiet /norestart
    ——-Housekeeping QA

    Housekeeping checks post removal additional steps. I can foresee someone will prophetically conclude a recommended step 5) Uninstall windows and install a secure *nix variant. Obligatorily mentioned in advance. Thanks.

    An eye on post removal Hinkyness had some hits after removals and reboots.

    1) Only two of the four uninstalled KB’s reappeared as available optional “Update for Windows 7 for x64 based Systems (KB3075249) and (KB3080149), another reappeared as

    Important “Update for Windows 7 for x64 based Systems (KB3068708)”

    The important one was the “Update for customer experience and diagnostic telemetry” Important to who, NSA?

    The “KB3068708″ Update for customer experience and diagnostic telemetry” did not reappear as an available patch. It may be dependent on one of the other three removed bits
    2) Before the uninstall, I had foresight to search the infected file system
    for .manifest with a common namespace string called assemblyIdentity which is set to a string value “Microsoft-Windows-Authentication-AuthUI.Resources”

    The before removal search listing files which matched the above search constraint yielded 62 matches in 52 manifest files.

    The after removal search listing of files which match the above search constraint yields 74 matches in 64 manifest files.
    Conclusion, the removal did not remove the manifest files pushed in the original infection.
    3) In a read of KB 3080149, it indicated it installed and updates / requires maintenance of a file named utc.app.json

    Before removal, the file file was found in 6 places on the infected filesystem
    After “removal” the file exists in the same 6 locations, same filesize just waiting for re-use and reinfection.

    discovered and removed using the disribed method 22 additional implants
    Found all 6 utc.app.json were removed and it had left two backup copies under the name utc.app.json.bk
    in
    C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings
    C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings
    in the same directory, found a backed up file telemetry.ASM-WindowsDefault.json.bk

    In order to see the hidden system directory, you must elevate to admin
    dir wont show the rest of the telemetry files unless you clear the files attributes
    An Elevated file explorer will show the files
    Files wont be readable until you change owner permissions or change your running user principal context to that which does allow access to the file.

    telemetry file content
    {
    “settings”: {
    “Microsoft-ApplicationInsights:::sampleRate”: “100”,
    “Microsoft-ApplicationInsights-Dev:::sampleRate”: “100”,
    “Microsoft-ApplicationInsights-Dev:::latency”: “Realtime”,
    “xbox.xsapi:::sampleRate”: “100”,
    “Office:::sampleRate”: “100”,
    “Skype:::sampleRate”: “100”,
    “Census:::sampleRate”: “100”,
    “Microsoft.Windows.Appraiser.General::ms.CriticalData:sampleRate”: “100”,
    “Microsoft.Windows.Appraiser.Instrumentation::ms.Telemetry:sampleRate”: “100”,
    “Microsoft.Windows.Compatibility.Asl::ms.Telemetry:sampleRate”: “5”,
    “Microsoft.Windows.Inventory.General::ms.CriticalData:sampleRate”: “100”,
    “MicrosoftTelemetry::ms.CriticalData:sampleRate”: “0”,
    “MicrosoftTelemetry::ms.Measures:sampleRate”: “0”,
    “MicrosoftTelemetry::ms.Telemetry:sampleRate”: “0”,
    “Setup360Telemetry::ms.CriticalData:sampleRate”: “100”,
    “SetupPlatformTel::ms.CriticalData:sampleRate”: “100”,
    “TelClientSynthetic:HeartBeat_5::sampleRate”: “100”
    }}
    content file of utc.app.json
    {
    “settings”: {
    “UTC:::GroupDefinition.MicrosoftTelemetry”: “f4-Redacted data-6aa”,
    “UTC:::CategoryDefinition.ms.CriticalData”: “140-Redacted data-318”,
    “UTC:::CategoryDefinition.ms.Measures”: “71-Redacted data-63”,
    “UTC:::CategoryDefinition.ms.Telemetry”: “321-Redacted data-32”,
    “UTC:::GroupDefinition.Microsoft-ApplicationInsights”: “0d-Redacted data-d0b”,
    “UTC:::GroupDefinition.Microsoft-ApplicationInsights-Dev”: “ba-Redacted data-3d”,
    “UTC:::GroupDefinition.xbox.xsapi”: “53b-Redacted data-af3”,
    “UTC:::GroupDefinition.Office”: “8DB-Redacted data-155”,
    “UTC:::GroupDefinition.Skype”: “9df-Redacted data-a89”,
    “UTC:::DownloadScenariosFromOneSettings”: “1”
    }

    To mitigate future infection, am considering removal alteration or perform a revocation of file permissions to utc.app.json and the hinky manifest files.

    4)Re the connections the malware opened, which may or may not have Mitm certificate pinning mitigation. My personal opinion is to mitigate by locking access to the data ex filtration end points.

    Firewall now blocks outbound access from your network to
    vortex-win.data.microsoft.com
    Name: VORTEX-cy2.metron.live.com.nsatc.net
    Address: 64.4.54.254
    Aliases: vortex-win.data.microsoft.com
    vortex-win.data.metron.live.com.nsatc.net
    vortex.data.glbdns2.microsoft.com

    settings-win.data.microsoft.com
    Non-authoritative answer:
    Name: OneSettings-bn2.metron.live.com.nsatc.net
    Address: 65.55.44.108
    Aliases: settings-win.data.microsoft.com
    settings.data.glbdns2.microsoft.com

    Chances are that anything outbound to “.data.microsoft” should likely be blackholed if you opt out of the “Idiots Do Opt Having Pervasive Surveillance Patches” IDOH-PSP program for short.

    Hope this helps to bring most of the malware workflow, as is early info on this new day of vendor sponsored in your face implants, info will likely be incomplete.