[forty-six]

Sample is courtesy kafeine blog.

http://malware.dontneedcoffee.com/2014/ ... ocker.html

Removed VB trash in partial unpack.

[EP_X0FF]

You can catch it decrypted data when in the second stage in copy of dropper process it calls NtFreeVirtualMemory. Nothing really impressive, actual malware data is about ~600 Kb, where ~500 Kb are BMP images and ransomware text to display and TOR linked object files -> https://doxygen.torproject.org/files.html, seems used for communication mechanisms, zlib 1.2.8 library etc

Code: Select all

Your personal files are encrypted.%f0%%c0%


Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer.

Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key.

If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files.

1. Type the address %c1%http://torproject.org%c0% in your Internet browser. It opens the Tor site.

2. Press 'Download Tor', then press 'DOWNLOAD Tor Browser Bundle', install and run it.

3. Now you have Tor Browser. In the Tor Browser open the %c1%http://%onion%/%c0%
   Note that this server is available via Tor Browser only
   Retry in 1 hour if site is not reachable.

4. Write in the following public key in the input form on server. Avoid missprints.
%f1%%c1%%key%%f0%%c0%

5. Follow the instructions on the server.

These instructions are also saved to file named DecryptAllFiles.txt in Documents folder. You can open it and use copy-paste for address and key.

Malware BMP's in attach.

[forty-six]

Thanks for the assist EP.

[Cody Johnston]

Recent sample from a few days ago. Marks files now as .ctb2

Interesting that the original packed exe is written using pcode (http://en.wikipedia.org/wiki/P-code_machine)

latest.exe:

https://www.virustotal.com/en/file/554b ... 409227700/

unpacked.exe:

https://www.virustotal.com/en/file/ab31 ... 409368968/

Also dumped memory from after unpacked.exe last allocation. (CBTv2.mem)

Seems it uses the same communication mechanism as before.

Thanks to decrypterfixer from BleepingComputer for the sample.

[EP_X0FF]

Recent sample from a few days ago. Marks files now as .ctb2

Interesting that the original packed exe is written using pcode (http://en.wikipedia.org/wiki/P-code_machine)

Probably you mean PIC, position-independent code.

[Cody Johnston]

Probably you mean PIC, position-independent code.

I meant P-Code, but gave the wrong link initially. Here is a PDF that explains a little better what I am talking about: http://www.decompiler-vb.net/documentat ... 0PCode.pdf

[DecrypterFixer]

Yep, VB6 Pcode at that. Its quite rare to see at all. As i was telling Cody in the past, i had to bust out a debugger from 2001 to figure out what was going on in it because IDA and olly are about useless with pcode. Of course you can still dump the unpacked exe from processhacker, But its torn all apart that way. The old debugger i used was able to dump it without any type of rebuilding, it was nice for a change.

[DecrypterFixer]

My apologizes for the double post, But i also wanted to point out that this infection has the capability to Encrypt, and do its Test 5 file Decrypt Offline with no network adapter in my VM. Just thought it was rather interesting

[r3shl4k1sh]

Ransomware that uses Tor in order to contact the C2.



Article:
http://securelist.com/analysis/publicat ... ansomware/

VT 20/56

In attach:
MD5: 10f0eaa794f48ad0b15034e0683cb15f

[Kafeine]

Sample come from my blog :
http://malware.dontneedcoffee.com/2014/ ... nd-it.html