Rig Exploit Kit via EiTest delivers buggy CryptoShield Ransomware (Feb 3rd, 2017)

The Sonicwall Threats Research team have received reports of ransomware known as CryptoShield that is being distributed through compromised websites using the Rig Exploit Kit. The copy of the ransomware that we obtained comes with a twist. Instead of encrypting files and offering their recovery after a ransom is paid it accidentally deletes them due to a bug.

Infection Cycle:

The Trojan has the following hardcoded IP address for the C&C server:

45.76.81.110

The Trojan attempts to report the infection to the C&C server with a unique user ID. The server was not operating as desired by the operators at the time of writing:

The Trojan adds the following key to the Windows registry to enable startup after reboot:

• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun Windows SmartScreen %APPDATA%MicroSoftWareSmartScreenSmartScreen.exe

The Trojan adds the following files to the system:

• %APPDATA%MicroSoftWareSmartScreenSmartScreen.exe
• {shared drives}Stop Ransomware Decrypts Tools.exe [Detected as GAV: CryptoShield.A (Trojan)]

It will then traverse all directories looking for files of predefined filetypes to encrypt. Due to not being able to communicate as expected with the C&C server the “encryption” process results in the files being deleted. The following 2 files are dropped in the directories containing the “encrypted” files:

"# RESTORING FILES #.HTML"
"# RESTORING FILES #.TXT"

The files contain the following data which are presented on-screen by the Trojan. It contains instructions for file retrieval which of course will not work for deleted files:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

• GAV: CryptoShield.A (Trojan)

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.