[Cody Johnston]

Has anyone seen this attached to zero-access rootkit ?

Yes, it is common, most likely a pay per install as it seems the PCs that I find have ZeroAccess files that predate the CryptoLocker infection. To my knowledge, there is no such ZeroAccess + CryptoLocker dropper. You can find the samples you need searching the forum.

Maybe have a sample of both, I am testing to see what can be done to prevent Cryptolocker from running.

You only need CryptoLocker samples, see above. Also, Hitman Pro has a tool as does BitDefender, both are very effective. FoolishIT also has one call CryptoPrevent. Use one of those.

Fellow tech and myself have had 2 users infected with Cryptolocker but also had zeroaccess attached which from some research seems to be point of entry in our case and Kaseya AV & Kaseya Malwarebytes Pro do not detect it at all KAV gets encrypted and rendered useless. KAM does not detect either, but the free download version picks up the rootkit and virus. Just wondering if anyone else has ran into this at all or not.

MBAM works fine for us and is usually quick to update if you find that they do not catch the infection. You may also elect to submit said sample so that they can add the rules in.

[Cody Johnston]

Here is a decryption tool by Kyrus that is an alternative to the tool provided by the CryptoLocker authors.

It will only work if you already have obtained the key from the authors via payment:

http://www.kyrus-tech.com/cryptolocker- ... on-engine/

[Khablam]

Are these droppers VM-aware? They seem to do nothing when I run them in a VM or in Sandboxie. And I have a specific VM without additions, changed hardware names/ids, etc.

It's likely the DNS lookups aren't resolving. The virus dropper doesn't start encrypting if it can't phone-home.

So it sounds like the C&C uses some brute force method for searching for the key. So what would that do? Try every single private key that it has generated to decrypt the first 1024 bytes until it finds the right one? But how does it know which is the right key after the decryption process? If AES key is truly random, you wouldn't be able to tell just by looking at it what you've decrypted is an actual AES key

I don't know enough about how AES is implemented to say exactly how, but it should be obvious to the algorithm whether the key it's using is returning random data or actual file data. For instance, if it's decrypted then the file header will be plain-text and parsable.

[RP-Tech]

You only need CryptoLocker samples, see above. Also, Hitman Pro has a tool as does BitDefender, both are very effective. FoolishIT also has one call CryptoPrevent. Use one of those.

I have been testing in a sandbox that i created the samples of just Crytolocker, to Test Kaseya MB and AV both do not detect it, AV will if its just CryptoLocker which is good but the ones we see have rootkit attached, as 1 user just received this pc fresh install of our image 4 days prior to infection. I have tested FoolistIT tool and it does work but still testing, client is to stubborn to allow us to do a GPO to help with issue.

MBAM works fine for us and is usually quick to update if you find that they do not catch the infection. You may also elect to submit said sample so that they can add the rules in.

We are working with MBAM and Kaseya both to give us answers as stated before CL by itself AV will detect and stop and free version of MBAM as well will stop it but our MBAM Pro 1.50 does not detect it at all. So I have been submitting samples of any variant I can get my hands on to provide them data to help us out.

Given there are good preventive measures and tools like FoolishIT, but the client just takes our plan of action and puts aside and wants Kaseya AV and MBAM Pro from them to be the tools to correct the issue. Pretty much beatting my head against the wall since this client wont take any real action to stop it but oh well, still researching and gathering information to help others at least.

[Quads]

Test with the likes of HMP-Alert 2.5.1 beta it runs in the background to block the encryption process so that personal files are not encrypted even though Cryptolocker is running.

Quads

[erikloman]

Hi Erik, on the demo video i see that the ransomware is still running and not suspended on background, did he encrypt stuff during this time ?

Sorry for the slow reply; The CryptoLocker process still tries to encrypt the files but is blocked by CryptoGuard's minifilter driver. Keeping the process alive gives forensic evidence to anti-malware tools.

[edmanz1]

Can anyone share some fresh samples? C2 is already sinkholed with every sample I've tested so far.

TIA!

[Cody Johnston]

Live C2: 192.155.83.72

https://www.virustotal.com/en/url/1c496 ... 384987589/

This one still up too:

46.149.111.28

[PX5]

https://www.virustotal.com/en/file/c7dc ... /analysis/

[r32]

Hello occurred to me that to protect those files that encrypts changing the actual file extension of an inventive. If we have a file.pdf you can change the file extension to "file.xx". Displaying file extensions in running encryption, logically should not encrypt it.

Under these tools that may be useful.
Tool to find files that have been encrypted:

CryptoLocker Scan Tool (NET 4.5 required):
Web: http://omnispear.com/tools/cryptolocker-scan-tool
D.Download: https://www.dropbox.com/s/ciw1rdzri8ghy ... 131025.zip

In this issue we have a script to try to recover the files when they have changed to another partition or folder. According to the author correctly decrypts files and rendered useless.

http://chief-01.deviantart.com/art/Cryp ... -413774308

Another option:

Restoring encrypted files with ShadowExplorer utility:
In addition to the native functionality of Windows, you can use an application that can restore the previous version of entire folders for you. Called ShadowExplorer. Once you download and run this program, it displays all units, as well as a list of the dates when snapshots are generated. Just choose the drive and restore the desired date

Web: http://www.shadowexplorer.com
D.Download: http://www.shadowexplorer.com/uploads/S ... -setup.exe

Other tools to aid the prevention CryptoLocker:

CryptoPrevent (Beta)
Web: http://www.foolishit.com/vb6-projects/cryptoprevent/
D.Download: http://www.foolishit.com/download/crypt ... installer/
D.Download (portable): http://www.foolishit.com/download/cryptoprevent/

Cryptolocker Prevention Kit:
Web: http://www.thirdtier.net/2013/10/crypto ... t-updates/
D.Download: http://www.thirdtier.net/downloads/Cryp ... ionKit.zip

Greetings.