Krypt3ia

(Greek: κρυπτεία / krupteía, from κρυπτός / kruptós, “hidden, secret things”)

Archive for the ‘Ransomware’ Category

Create NEW Ransomware: Darknet Site Ransomware Scheme

leave a comment »

Surfing the darknet as I do, I came across this little gem of a site today. The idea here is that you can share in the bitcoin ransom by entering your wallet address and then getting a download of the malware to deploy wherever you like. This seems like a ponzi scheme to me where you offer a great reward for a little action and in the end you get ripped off but ok, let’s run with it. The site is in the darknet and I am not sure if or how they are publishing this site elsewhere so people can find it and use it. I must say though that the site is more complete than I thought it would be once you start to dig and the ransomware is new to me as well as it seems to be to VT and Hybrid.

So yeah, I decided to play along and I used someone’s wallet to start the process here. Who’s wallet you ask? Well this guy’s wallet will do since he has never had anything in it. So it’s fairly simple, you put in the wallet address then solve the captcha and lo and behold you download the ransomware. I also decided to see if I put in an alternate wallet address would I get another hashed file, and yes, yes I did. I only changed the wallet address by one letter (a) and got a new file that I uploaded to VT after the first one.

 

Upon upload to VT and Hybrid I get hits on the major players and the designation of the malware is of course ransomware but you choose the name you like because there are too many per the AV firms (please stop this)…

So yeah, the ransomware is not so stealth and likely anyone with current AV will have some intervention one hopes …But how many really keep their AV up to date and working?

*sigh*

Anyway, I uploaded it to Hybrid and got the following report and the second with the second sample here

 

The malware reaches out to the darknet via .casa online bridge to the darknets. Once you plug in that address you get the Qrypter site frontend. This site is your C&C ostensibly to track your malware and your bitcoin “donations” from the poor sods who get the malware. The unfortunate bit is that when you go to the url that is in the malware you get the following sad news:

OH NOES! Are you smelling a scam? Cuz I am kinda smelling a scam here now…

Anywho, the interesting bit for the site itself is that it has a display on how many AV vendors are seeing the malware and as of today it’s… Wrong?

Mmmmmmyeaahhhh no, I see 14 vendors seeing this as malware and I have just added to the hash pile by uploading my samples here so that is likely to get even more detected as the day passes on. So, this is an interesting turn in malware as a service, or in this case Ransomware As A Service (RAAS) as I have seen out there on the net. I have captured the whole site in the darknet and I will be spending some more cycles on the malware later on so updates will likely follow on this post. For now though, just enjoy the novelty and the derp.

Cheers,

K.

UPDATE: This is evidently a new replay of something seen in 2017

Written by Krypt3ia

2018/02/19 at 15:49

Posted in DARKNET, Malware, Ransomware

Halloware Ransomware On Sale Now

leave a comment »

 

I was paging through the new sites on the darknet from the spider and this page popped up. Upon opening it I saw the evil clown and thought RED ROOM but instead it’s a site offering a new-ish ransomware package by a person(s) calling themselves TNCYBERSQUAD or as I later found out a Turk with the handle of LUC1F3R. So the site says you can buy this new and undetected malware for a mere 40 bucks lifetime! They even give a scan on nodistribute that shows the executable not being detected by any of the AV vendors out there now. I poked around the site and checked the page listed in the clown image and found that their landing page for collection on their ransom is not fully operational. I could not get the link to their bitcoin system to work nor would the site render all the images either.

I expanded my search to see if I could use the hash from the nodistribute session and got no love at all on this. Of course the exe and the hash are brand new with the actual dates on the testing and the offerings for this malware being from 11/30 to today. The only problem I have with this is that I cannot verify the sample as something that would not be seen as clean because the hash, when searched turns up absolutely nothing and the executable is not on offer unless you pay them as well as email them. So, this file could be just a lot of nothing in an attempt to scam people into dropping 40 bucks and getting nada.

MD5 HASH: b01230be6e42bf7210ce244ca493a697

I actually put a cutout address into the email on the page and hit send and as yet I have nothing back from luc1f3r at all. In the interim though, I started looking outside the darknet for more and I found some interesting tidbits. First of which is that when you start looking for Halloware you come up with some YouTube videos and links to a site that this seems to have first been posted as a free download. The file downloaded is not the same as the one offered in the darknet and when run in VT comes up as a trojan.

This site is pretty open to just giving up contacts and the malware so I think this is just proof of concept and now they have moved on to application and monetization. I may go down the rabbit hole more on the email addresses and other details there but for now I don’t see this ransomware as a real threat to much of anybody unless the sample gets out and is then used by the masses. When I began looking at the code of the darknet site and links in other places I came up with another site outside the darknet that mirrors the hidden site but has some interesting code.

These guys are collecting IP addresses too

Aanyway, I watched all the YouTube videos and basically Luc1fer shows how you can hide the malware as a file etc in broken english on a text pad. He show’s an IP address too and generally has crappy OPSEC.

 

 

All of this stuff seems predicated on a python script and some manipulation so I am not sure how they claim there is no programming knowledge needed to create the malware but ok dude. I know that ransomware is all the rage but honestly this one seems kinda weak and maybe just a scam. I will keep an eye out for another sample though. Until then you may all want to take that hashes from VT I pasted in above and add it to your systems to detect it. Luc1fer made the rounds today offering the malware and the darknet link on a bunch of shops so maybe people will take em up on it and send out a blast.

I will update if I see more.

Have fun!

K.

Written by Krypt3ia

2017/12/01 at 18:16

Posted in Malware, Ransomware