Ransomware has been the buzzword in recent times, this subject has exploded over the last few weeks ever since we saw the ransomware epidemic – WannaCry. It is of little surprise that many are trying to capitalize on Wannacry’s popularity. SonicWall Threats Research team received reports of one such copycat ransomware for Android.

Infection Cycle

The app requests for the following permissions during installation:

• Read external storage
• Internet
• Get tasks
• com.android.launcher.permission.read settings
• Read logs
• Access wifi state
• Wake lock
• Set wallpaper
• Access network state
• Read phone state
• Modify audio settings
• Mount unmount filesystems
• Change configuration
• Write external storage

Upon installation the app disappears from the app drawer, but a new icon is visible with the name lycorisradiata – which is the name of a plant red spider lilly. This however is not a new app, it’s the same malicious app with a different app icon.

The malicious app changes the wallpaper of the device, below are few wallpapers that we saw. They dont seem to be connected in any special way:

The malware starts attaching an extension at the end of files, like other popular ransomwares for Windows machines. During our analysis it attached the following string:

Below we can see the code calculating the string to be attached:

The ransomware shows a warning message if we open a different app i.e. push the ransomware in the background. The message warns the user that the files will be removed if the application is quit, this is a fear tactic used by the malware into coaxing the victim to pay the ransom.

The ransomware begins encrypting files on the system using AES and it is careful in avoiding system files. Ultimately we see the same screen layout that was used by Wannacry to cover the entire screen.

As a ransom the apps in this campaign ask for either 20 or 40 RMB (1RMB approx 0.15 dollars). It accepts the following payment methods:

• QQ chat
• Alipay
• WeChat

This is clearly an effort to utilize the popularity of Wannacry to scare the victims into paying the ransom.

Interesting points

• The malware requests for ransom in RMB
• The malware opens a connection to biaozhunshijian.51240.com which essentially shows the current time in Beijing
• The malware accepts payments in the form of QQ, Alipay and WeChat – all these three apps are highly popular in China
• The above points hint at this campaign’s target and the possible source from where these malicious apps arise
• There is a function deleteDirWihtFile which has checks in place to avoid files and directories with the following names:
  • android
  • com.
  • miad
  • baidunetdisk
  • download
  • dcim

Overall this ransomware is trying to utilize the popularity of Wannacry for its own goals. It tries to scare the victims into paying a ransom by using the popular Wannacry lockscreen. By using non-crypto currency for its payments the authors are taking a risk of getting tracked down. Coupled with the fact that the ransom demanded is not very high, it looks like the authors are trying to make a quick buck.

Can Wannacry infect Android devices ?
In the current state – NO. Wannacry used a specific windows exploit that can affect only windows systems. However people are still recovering from the effects of Wannacry, so scare tactics – like the one used in this malware – are expected.

SonicWALL provides protection against multiple versions of this threat via the following signature:

• GAV: AndroidOS.Wannaclone.PK (Trojan)

There is a new ransomware family have been observed in the wild which is called the Not Petya Ransomware. It was originally identified as Petya family because both have the behavior replacing boot drive’s Master Boot Record (MBR) with a malicious loader. However there are multiple novelties in the new Not Petya ransomware compared to Petya, such as taking use of the NSA EternalBlue exploits similar as previous WannaCry ransomware.

Infection Cycle

1. Upon the execution of the malware, it first setup the shutdown of the system and related tasks:

2. Then, it goes through the local network looking for targets:

3. Any existing IP will be checked for the SMB service and infected if possible

3.5 The following code shows the SMB requests with path IP/ADMIN$ will be sent to detected local computer:

4. After the set time, MBR is replaced followed by a system reboot. Below shows the fake system repair message, which is similar to previous Petya version:

5. The victim is required to pay for the decryption:

5.5 The bitcoin address is found to be hardcoded into the malware:

6. According the code, Windows Management Instrumentation Command-line (WMIC) interface has been used:

A bitcoin address accepting the payment has been identified in the exploit. There are total of 34 transactions have been seen worth of more than 8,600 USD as the time of this SonicAlert is released. The exact transaction can be found here. However it has been reported the Email address was blocked around noon today, which means the payment might not help to decrypt the victim’s infected computers.

With further analysis, we found the malware code wipes the beginning sectors on the hard drive except MBR before save them anywhere, which render the machine unrecoverable. However, the files in the system are encrypted and recoverable, but only recoverable by knowledgeable professional with the decryption key.

Full Code Walkthrough

The first thing it does is to provide itself necessary permissions and then checks the running processes to create a key (using a xor based algorithm on each process name) if the key matches certain values then it would later perform or not perform some actions. Means if looks for some process names which if found would make the malware not perform some actions. Next it checks if the dll file is installed already in windows folder. If installed the sample would not do anything further. Next it infects the raw disk.

Disk infection:

First overwrites 0x200 bytes after the first sector from the logical drive c:. This is where the Volumn Boot Record is present which is more than 1 sector. Hence the 2nd sector of the VBR is gone. The system cannot recover. Then based on the results of the running processes found earlier it proceeds to infect the MBR. It creates a buffer of 60 random bytes using crypto apis and then use each of these bytes as index to select from another hard coded list of characters to generate the personal installation key displayed on the boot screen by the infected MBR. Because the above algorithm is going to generate completely random personal installation key there is no way the attacker would be able to find out how to decrypt from that information.

Next it reads the MBR, xor it with 0x7. It would later write this xored MBR at sector 34. It also attempts to check if any partition’s LBA (its start location on disk) is less than 40 (0x28) to find out if it has enough space to write its own MBR code. However this checking code is faulty and it ends up checking if only the last partition. It then overwrites 0-24, 32, 33 and 34 sectors. 0-24 sectors contains its MBR code, 32 contains the bitcoin address and the random personal identification key, 33 sector contains all bytes with 0x7 and 34 sector contains the xored original MBR. If somehow the MBR infection fails then it attempts to write junk on the MBR.

Mimikatz: Next if retrieves the mimikatz from its own embedded resource and drops it as a temp file in temp dir. It creates a NamedPipe from a GUID and passes the name of the pipe as parameter to the Mimikatz process it creates next.

Mimikatz provides all the username/password combinations it can find like this:

Here username and password found Sagar and SonicWall separated by ‘:’. After this is received through the named pipe it searches from the ‘:’ separator and writes down all the usernames and passwords. It would use both PSEXEC and WMI later with these credentials to infect other systems over the network. It then nulls out the mimikatz on temp dir.

Next it would drop the embedded PSExec as ‘dllhost.dat’ in the windows directory.

Use of PSExec and WMI: For lateral propagation it enumerates all the ip addresses on the local network and attempts to access the admin$ share on that remote system using the username, password found by mimikatz.

If it can access the share it would drop a copy of itself on the remote machine windows directory. Then it would first try to run the copy.

First it attempts PSExec. With command line like:

C:windowsdllhost.dat \ -accepteula -s -d C:WindowsSystem32rundll32.exe “C:Windows“,#1

If this does not succeed then it attempts wmic with command line as:

C:windowswbemwmic.exe /node:”” /user:”” /password:”” process call create “C:WindowsSystem32rundll32.exe “C:Windows” #1

According to the above code analysis, the code in these sample does not resemble at all the code in the original Petya ransomware. The only similarity is MBR infection behavior. Thus we can conclude that this is likely the work of someone other than people associated with Petya family of ransomware.

Prevention

To proactively prevent from being attacked by this malware or mitigate the damage, please:

1. Keep your computer with the latest patch, especially apply Microsoft Windows security update MS17-010.
2. Enable the Windows Firewall to block incoming requests to ports 135, 139, and 445.
3. Disable SMBv1 in Windows https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and-windows.
4. Segment your network into multiple network section especially in the company network environment.
5. Switch off your computer when you see the fake CHKDSK screen to mitigate the damage.
6. Do not pay the ransom. Firstly the Email has been
   blocked by the Email provider Posteo, so your payment message will not be delivered. Secondly according to further analysis the exploit code cannot recover your computer.

SonicWall Detection

SonicWall threat research team has researched on the new Not Petya malware and developed the following GAV signatures:

• GAV: GoldenEye.A_5 (Trojan)
• GAV: WisdomEyes.A_2 (Trojan)
• GAV: GoldenEye.A_4 (Trojan)
• GAV: Petya.A_8 (Trojan)
• GAV: Petya.AA (Trojan)

SonicWall threat research team has also deployed multiple IPS signature in April/May 2017 detecting EternalBlue or MS17-010 vulnerabilities which are proactively blocking the new Not Petya Ransomware:

• 12700 Windows SMB Remote Code Execution (MS17-010) 1
• 12792 Windows SMB Remote Code Execution (MS17-010) 2
• 12794 Windows SMB Remote Code Execution (MS17-010) 3
• 12800 Windows SMB Remote Code Execution (MS17-010) 4
• 12814 Windows SMB Remote Code Execution (MS17-010) 5
• 12849 Windows SMB Remote Code Execution (MS17-010) 6

SonicWall Capture ATP service also detects the malware binaries associated with this threat.

Above signatures shows us a huge spike recently exploiting MS17-10 vulnerabilities, which including the SMB traffic that the new Not Petya Ransomware generating:

Last updated on June 29, 2017

The SonicWall Threats Research team has been monitoring a ransomware threat known as Master Ransomware. This ransomware is a variant of BTCWare. The operation of this ransomware is very simple and follows the classic extortion tactic: encrypt files and demand a ransom to get them back. The important thing to note however, is that there is now a rising trend for ransomware to charge even more money for file decryption. In this case, 1 BTC (currently $2701 USD) is required for file decryption.

Infection Cycle:

Upon infection, the Trojan displays the following text on the desktop background:

It also displays the following text file:

The Trojan adds the following key to the registry:

• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun DECRYPTINFO %AppData%Roaming#_RESTORE_FILES_#!.inf

The Trojan traverses all directories on the system and encrypts files in those directories. It leaves #_RESTORE_FILES_#!.inf in each directory and renames each encrypted file to {original filename}.master. This directory traversal includes any attached network drives and attached external media storage.

It also drops #_RESTORE_FILES_#!.inf onto the desktop:

#_RESTORE_FILES_#!.inf contains a unique ID and instructs the user to send an email with this ID to crypthelp@qq.com in order to receive instructions to decrypt files.

We followed these instructions and received the following email:

The email instructs the user to send 1 BTC ($2701 USD at the time of writing) to 1HAvKnunqW8xPjEwRYJjMeYnA5sPCyBvAB.

Although this ransomware is very simple, its operators have been very successful and have netted 62.2 BTC so far. This amounts to $168,000 at the time of writing this alert:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: Master.RSM (Trojan)
• GAV: Master.RSM_2 (Trojan)