There are not many things that can ruin a day as much as an attacker holding your files for ransom. There are feelings of violation, as they have clearly tampered with your private data, a pit in your stomach when you see how much it will cost to get your files back, and overwhelming guilt as you weigh the pros and cons of actually paying these low life criminals. Many have been feeling these emotions lately as CryptoWall has been on the rise, most recently with the campaign infecting users via malvertising on sites such as Yahoo and AOL.
CryptoWall, the successor to CryptoDefense, is a particularly effective piece of ransomware which encrypts a user's files then demands a Bitcoin ransom be paid in order to decrypt the files. The current campaign of CryptoWall infections is using malvertising as an infection vector, but in the past, various forms of email spam have been used. Let's walk through an attack we saw back in early June.
The Attack
Early on a early June Monday morning, a few of us here at Cylance received an email.
This email explained an erroneous transfer from a bank for just over $6000. Attached to the email was a zip, presumably with more details about the transfer, but actually containing a SCR file (screensaver). I read this email just after waking up, with crust still on my eyes, and knew it was going to be an interesting day.
By time I got into the office, there was already an email thread about how quite a few people got this email. It was noticed that none of the engines on VirusTotal were detecting it, and that we were not the first to see this spam campaign. Even just the method by which we received the sample indicates it's malware, so if it's malware, shouldn't AV detect it?
It takes just under six hours for major AV engines to start catching onto this threat after the first submission to VirusTotal. Granted, this is expected as the sample is not something they have seen before and does not match any of their signatures. It will take time for researchers to pick apart this file, determine it is malware, then to create a signature that will catch it without falsely detecting non-malicious files. Not to mention, an update for this would also need to be pushed for non-cloud based solutions. This is quite a bit to ask of a research team to pull off before an infection can spread.
The Difference
While I was dreaming away, imagining myself battling through the world of Hyrule, Infinity already knew this file was a threat. Actually, the Infinity Local model generated on April 30th determined this file was malware, as well as similar files.
Analysis
The sample we received in the email was d00b92837467c301f5359943d955dc7a4d59f0136b4e90715d5d97ee0a9617d3 as an SCR file. Screensaver files execute as executables, but are often used when attempting to trick users into running malware. This sample in particular is a downloader setup to download a copy of CryptoWall, a family of ransomware.
When executed, it would run Upatre, a dropper, which downloads encrypted files from remote HTTP servers. This can make it difficult to detect the network traffic.
CryptoWall
CryptoWall is a second generation ransomware (CryptoDefense is its predecessor) which utilizes Tor and RSA 2048. Let's run through an infection real quick.
When we look at the sample we can see it is using either the VirtualBox icon, or one similar to it.
After double clicking on it, it runs quietly for a moment. After that moment, it will start to use 100% of the processor, and turn off the Windows Security Center.
Shortly after this, it will delete itself from its original location and we will see an increase in HTTP traffic as it calls home. Before the self deletion, it will inject itself into another running process. This is considered a malicious behavior in CylancePROTECT's MemDef, so even if the file itself was not detected as a threat, this behavior will be blocked, stopping the encryption of files.
At this point, the user's files are being encrypted if they are not running CylancePROTECT. Once it has finished that, it will pop up 3 windows to the user. Two of them are informing the user that their files have been encrypted, going into detail about how the files can be recovered. It is done in two windows as one is a text file and the other is the HTML representation of the same information.
The third window that pops up is a web browser window open to a Tor hidden service hosting the decryption/extortion service. It requires you submit a CAPTCHA before proceeding to recover your files.
The attackers are requesting $500 worth of Bitcoins in order to recover our fictional victim's 22 files. Now, if you are willing to pay $500 for any number of your files, I highly suggest you start using a means to back up your files. Most cloud storage services, such as Google Drive, allow for recovery of previous versions of files. This means that even if attackers delete/encrypt your files, you can recover them. Do not let yourself to fall victim to an extortion scheme that can be thwarted with minimal effort.
Bitcoin
We can gather quite a lot of information from a Bitcoin (BTC) address. Essentially, BTC has created this large scale, peer driven economy, which requires public confirmation of transactions. While it does have some inherent anonymity, it also makes quite a bit more information public. For instance, if we wanted to get an idea of how many people have decided to bite the bullet and pay off this extortionist, we would only need to watch the BTC network for transfers to this address of around 0.79 BTC and 1.59 BTC (for the $1000 upswing).
Four infected users paying for access to their encrypted files
There are some fundamental differences between traditional currency andBTC which can make things a bit difficult to track where BTC are going. The first being that BTC are not single entities, but instead transactions are done in fractions of BTC. The other being that BTC wallets/addresses are trivial to generate. This means someone could create a large number of BTC wallets in order to move their money around. A large amount of BTC could be hidden in a large number of wallets. There are also services which pool BTC into a collection of wallets with other users' BTC in order to launder BTC. Given all these potential complexities, we will likely need to treat the BTC network as a graph.
In the campaign from the attack mentioned above, I was able to gather 4 BTC addresses by guessing user keys on the ransom site. They are displayed below along with how many BTC they received from extortion.
1L7SLmazbbcy614zsDSLwz4bxz1nnJvDeV - 100.66596583 BTC
19yqWit95eFGmUTYDLr3memcDoJiYgUppc - 67.99258172 BTC
16N3jvnF7UhRh74TMmtwxpLX6zPQKPbEbh - 29.37682569 BTC
1ApF4XayPo7Mtpe326o3xMnSgrkZo7TCWD - 99.1159107 BTC
With a total of 297.15128394 BTC, this campaign appears to have made quite a bit of money already (at current conversion rate $105,549.78).
If we treat BTC transfers as we would treat generations on a family tree, we can start to get some more information from these BTC addresses. With some thanks to BlockChain.info, Gephi and a Python script I put together, we can visualize this data. Let's first map out all the second generation BTC addresses (addresses that received BTC from the known ransom wallets).
First and second generation BTC wallets from June CryptoWall campaign. First generation in blue, second generation in red.
If we look at some of the second generation BTC wallets that have more than one of the ransom wallets sending it BTC, and then look at any other wallets sending them BTC, we can identify more potential ransom wallets. From the family tree perspective, these wallets would be siblings. Additional checks to confirm they are more likely related to CryptoWall is to check for ransom like payments (similar costs, payments from multiple addresses for similar amounts).
1JTEjiizLihT6GbvoW52Abmg6rV1KyD3fw - 67.07551282 BTC
13BeAzA4mhwDYJEwhqNd2LsUnuhuVqKvw8 - 39.08133736 BTC
1DSHfFTxJYpwTakXhKogJ5jdXPCQpXLTn1 - 2.72 BTC
1PHanqbJCsoyGMMLqvvznHwp9wh1zygkxp - 46.49512362 BTC
1DMgHqg4d6LXmEvohtYANpv2yMKQteKahn - 59.36315446 BTC
1CeA899xpo3Fe6DQwZwEkd6vQfRHoLuCJD - 112.17284189 BTC
1PnPJfx4ct8YHRnTnx1VrSnrZeQik86BXa - 59.56403407 BTC
185dzdGaxhFhwTdphAWEe4CjjXnutzKYYm - 64.25211267 BTC
1LPAUi1LWzCsRLkGFWFdN5sENs1LufBfNp - 45.32544979 BTC
1bTuCtgEtouAC7mrCrY6zzWCphSDLvxAo - 10.0495 BTC
19Dbxn926nCNqimjzfcjvJv4EKno6LBYv6 - 11.12 BTC
18e6Wtkvpf4L9RHwzbgvR9QTUVm1yBybwu - 26.13910156 BTC
1HYDwtwtotSedCDCHDcgbRks2a7yPcicwd - 96.85726223 BTC
1M8oK3D2G8ipTy7sCxiatrHC35CpAgmrrw - 99.81357946 BTC
13Kqgurx7eQg3G29NwV7ouJ8UHJRSUwwAe - 86.40750979 BTC
14bD9RgtJeKxdJMm5SRbmzFcsk8azTheR9 - 12.9409 BTC
1FUEYosFFP9X93yrPzeW5YQpbtpg8eq5Gd - 2.46 BTC
1Pa7ZkA9JHzwp8FazU4YBVSiYFPP3majgA - 31.83847394 BTC
13MBSSp3kciFsLgRkFe1nyB6v9rM2fZZ7L - 5.2 BTC
1DzV31VpoKgGBCCYPQafAjUjQAMdUHRGQv - 70.96645713 BTC
1Fp1cVAZ1Ne21ta6UvFiSgvPTjTqHt3TNY - 5.3012 BTC
1McQPMgvRfatXFVPvWEB1byxzgV2d6FPTq - 9.38393985 BTCWith these sibling wallets totaling 964.52749064 BTC ($341,621.57) to puts this campaign closer to 1261.67877 BTC ($446,868.22).
With the current campaign, I was only able to obtain one BTC address from the ransom site as they increased the obscurity used to hide the number of victims. It also appears that they have attempted to reuse BTC wallets less.
128pJdREzcR6xorYPQAPzGf8RwMQjRBzDt - 1.33 BTCWith this address, I was able to identify two second generation BTC addresses which could be used to identify more wallets. This resulted quite a few addresses, as can be seen below.
Sibling analysis graph with 4 generations, blue wallets are the first generation wallets (including siblings).
1AkNkGDVk4N9cvrQrUXzZGVeX3fi1GDAnn - 1.33 BTC
186Qu4CHMMEMcRFhxvujCvAKD3vx6ziUZi - 2.7818 BTC
1DPMLWTaeGJK49fifnXxHdhH3ZysD7NEQJ - 4.15 BTC
1MViQ9sSrDi1REwbzttPjz8UwDwWRcrBa5 - 1.33 BTC
16V3i18DPUtJG5Kp5GHjCDjaUG4qjByqeD - 4.14 BTC
1hBGyAMPci57kjMRuHtTiiEiyMPPbkNog - 2.66 BTC
1Dip1BUWcLFbpa4v6UVM7stfiq9GrTztor - 2.69007998 BTC
1ELAQv2DQqApozVVzP4UhpNgAKFFRBAXLP - 2.66 BTC
1NZBme7eTYYd27bJaCarLkcjWUJSb6Uhoz - 1.33 BTC
1BaVeW1MDm5Z7krsNYRocGPqoPtvVgeFcC - 1.33 BTC
1Q1BhkHTyZBSJYs4jU5BEL5mKqzmxKqdUb - 1.33 BTC
15VdJ1x7mrvydpverBoM52uK32zthEgx3W - 1.33 BTC
1TifpG8S3LJTGDU9C5k9GbuYXza3DQohf - 1.33 BTC
1BRaWwcyNVx1Mzs36Xthu85xdo8DZwbWrd - 1.33 BTC
17QqTQk1GKMU2CuDHYBjvcCKcFzWTsvLzD - 5.22576667 BTC
14obpFxKhyj1XtRSJvyQ59x4JRwqvqCrJR - 2.68 BTC
1LNfzXzGuXiZK5iZb3Qvn22QfLBHgEfikN - 1.33 BTC
1B8mUXmLedyP13FcdTxtQCNwWjsYGt1uJX - 1.33 BTC
12oTuPZVabXXdyHAC7XG3vtgz61vtykaPB - 4.10387652 BTC
1BZMBivN1AL9DWQCdEnmviSKiMpnicTTBK - 2.66 BTC
1MbTd6iEqyrCAKZGvwR2QkAPMKXZ3727Hv - 2.7970395 BTC
15uMyfPokMN1BQUjvdPAcP5afCv5zGBfGv - 1.33 BTC
1Fn58MQNj23k2NUcZydCfhNUwzjbmGnK9a - 5.56 BTC
1BiVJbHQnAv7gnK6jjgx5inscEGYinzdRD - 1.33 BTC
1GqE8msa63edwhF96EszPozVGR9fuwPGDb - 1.33 BTC
1255ZtL5HXVNugwsxUvbSJSLUe2JDWLVmA - 1.33 BTC
1LsxkDcoK9MdD59o5rMw1dgDpGN8QoNbPp - 1.33 BTC
17Akvqrmria6v1gBPse3N1cNKKS8hHNm92 - 1.33 BTC
17okEyiGjTiqRkmxoFQRJt98BdYcXF1JeA - 2.74 BTC
19tH6f9UeLR64GfqcxwDUrGQVXXA7bg7LY - 2.75 BTC
12WW3RcXZ8rvGc9EyhZAgRcVQEUZBYR8o6 - 2.66 BTC
1HkzycvwurGTfYe99qYq55uN9HzocMYysg - 1.38205539 BTC
15MSrtpUkb9jBrr22ZXetrgDiynvLeHNDh - 1.33 BTC
1GEoemCD9LURzv4fqiARDiCuwb2n3sYjYP - 4.22811022 BTC
1MKwudaRV65RKNANrUS7mXTtMA5ndVTzHB - 1.33 BTC
12uVUzTrvUr8ACfSt57UstYU1E1edeEfnM - 2.77131309 BTC
1KF5VSK9PB1tcS5aH6TcwnvgL2C9nbYmNS - 2.659 BTC
1EiGZ5gBCYpJDPzcqyFois3gPNSXKT7jrt - 2.657 BTC
1P9dhkjAU4jPcW8iE5Uq3kj2W2A6oQc6mK - 1.3299 BTC
19JzWgQB4skxzH5ytvkJZbVMuLuwxoqjZy - 4.0 BTC
1JdYxTXNKxmYMWfDsW5mfAAV492AgHL1vY - 3.9401213 BTC
1Fgs8SMZV19eMta7pyZWiPH3Xkru9EZQeD - 4.8327 BTC
1DxR7rfGBto8przrBjhcrxfHpAr9c9uoYn - 8.06 BTC
1EniVnm2sh6EPe8TwyKT5KfBEkBK5g5Jgk - 5.3344251 BTC
1esih63MxWnwq4PLssmd6339fvfHdR8ww - 7.990826 BTC
1H3qbVbbm9JbwccofgGePhBCHaUXuVbkES - 4.01 BTC
1HzLH5UEo1rUdEA8g8afz6tR4EXfkCLnZr - 5.38 BTC
1D5FAyoTKhYbEPbiuSUSesg7hyVHB2uEJE - 5.42131588 BTC
1PvSDtss2WVhCykJJo5CkQZS6SVdpAM1U6 - 6.68 BTC
1JtwRHdDt2TXV1ixkcsJhkK5jd5W7nrRGe - 6.66889255 BTC
1L4GWsdFaKWEEk8Y1kC2nLGReZrqq9VL4Z - 6.58886523 BTC
1DVtLHgEtyLvECoLyioApckNrVrtnvcoMH - 6.63389119 BTC
1H7AWaRpq7TqzvY8ZNnY6Kc754sDy99KHr - 3.96163444 BTC
1JfC2gFma5sAwAJb5vPqd2yuYnvStLdw4U - 3.99 BTC
1ET6Ww6ZMyjduWYpKxefb5J52tPnxX8hBw - 5.408 BTC
17ddD4YpRYz1sF6b4PJTp5tZrmCBWdn9wH - 4.01285519 BTC
13t2DQuBFdiFRBH8rLA1tR1kUTfmjDQeSq - 9.3281922 BTC
1BST18ERfbd1fEbKuAyxt7or9RnocLA8ZN - 5.32662234 BTC
1KQzPxuuBx7YMAjMSWVn9zA5xEE4Leswyt - 8.05 BTC
1Gt8D8LL7orCkA7wV3KCgy8RZk7fwGJXqh - 6.8967 BTC
1KwsdZqtPzJFnAKzNrJF5hJQwB1xmt3WmD - 9.42282357 BTC
1LQXVRTN3CYfgQuyq9pLYL5jxGdrtaf2Kn - 8.06 BTC
1Pvfbp9RLyXgzcKz39AMAxamDTs36E9Xyp - 12.28677696 BTC
1757vJTmTfrTM6PUqN47STGugtDoqJxuNU - 6.75 BTC
19VmUZsg9iDgHc1MTPXhuPki3rsaq9yuys - 14.86719338 BTC
1KjttixbZBTDLhc4vTtCVYQUV4A1QXV3CE - 2.66 BTC
142abHo5n5HLzXna2w1b5MhNaManz2huJg - 5.49 BTC
18cKEYDd7sPboo4pfsDeDo7oUfF6CCVWoQ - 4.05 BTC
1McQPMgvRfatXFVPvWEB1byxzgV2d6FPTq - 9.38393985 BTC
1EeFT9NPG77XVEyRP68EkxhP7TzbVcBoJT - 9.175 BTC
1HpTyt4qXo53YJx5TCqV62Goe22TneFPNf - 10.48633672 BTC
133iB9RkbJbRPHqS2z4xa12XddEovod3sS - 10.60004689 BTC
144Fvd1mJxD51hKsRZFjB6yxyw2J32hmKT - 14.58590348 BTC
1Ax3LtWE9G53GTa2HWuga4JUrd2QCUx5pj - 14.92543359 BTC
162Cc4ad5C23RwYBytFyi2NxKGDoncasV8 - 11.97865224 BTC
1GCs9dgmutp2gNGNDCcmVp9NZ83VMNYpje - 7.87208905 BTC
156ZRB1QWJpuGA9da3uHWAkvZM5irRHonR - 2.6 BTC
1AEAhaGNMRnoTSeLE8GH9yybK2RuWXHCvM - 3.87328296 BTC
1PNt4XscuP3HrwVHwuN5VheecgX21nTuVs - 9.15653123 BTC
1DLE9cULDPBVAtUhkpuRbi9MVfw9T14e7 - 14.7 BTC
196fcXLHUG8tfSN5Wqhf6Xu4LNQikzuXoy - 5.17409 BTC
1Gq6Cc4n13Zc2JCfHgzbeHnytMV2MhiZgc - 9.26647046 BTC
1AgmTcktxt44KemAfrLBNEerGQQrWUbJZw - 9.2229941 BTC
1JPutxXJxopCF1qyZEbM98UkkrxdYDPzDo - 8.10997938 BTCFrom these results, we can see 427.768527 BTC ($152,356.44) being paid out in ransom in a short period of time. It is likely with more in depth sibling analysis, more wallets could be identified. I should note that these results are from an ongoing campaign, and will likely rise.
Current Campaign Sample
With the current campaign, we have observed the following sample dropped after infecting browsers through malicious advertisements.
4cf1d2f01e4206afbb7abcfb48953e59f0869f020d5fb4946abef31fadefdbc9Like with the previous campaign, the initial detections from the industry are not strong, although they show improvement.
Yet, our detections are solid across the board, giving full confidence that this sample is a threat.
With a model built in August of 2014, we were and still are detecting this sample as a threat. I should note that this sample was compiled on October 16, 2014, so yet again we are detecting threats before they are even compiled. Not to mention we also block the process injection behavior that this sample relies on to encrypt files, giving you another layer of protection.
Conclusion
CryptoWall and other families of ransomware have been effective and continue to be. They are a powerful tool to generate income for attackers, and they target all end users. If you are unable to protect yourself with advanced threat detection services like CylancePROTECT, it is suggested you regularly back up important documents to secure locations that keep historical versions of your documents. If you are able to protect yourself with CylancePROTECT, then you can rest easily.
Samples
3ebc91c46adc09f9c5928b37dac7902f061a13c13ab2826fe9ddef8269f68eb2
45bd17aaac7454c7473ffdd799cbe0cead8f54b7cb7a553656a0a6f8670bd57d
4cf1d2f01e4206afbb7abcfb48953e59f0869f020d5fb4946abef31fadefdbc9
66be3cf487dcf97f4aaba67de2ee4f5cfaf79d62dab5737eba2a1ffde1b7d34d
a92ae8e80b0b70288a32c0455856453c5980021156132a540035e7ef5e0fa79e
afbf57bddf2c5eba48d2aa2de4d8880cc582e3bfd918b05ec77def90c689841c
bb84cca6de19cb721fa8d180f8aa80b7ea591e4885c62f6577e445654723d7f3
bc5998ba55ead151eff8d1531f004f9c0a9d62066efd7656d40dad9f2c074624
d00b92837467c301f5359943d955dc7a4d59f0136b4e90715d5d97ee0a9617d3
dae6e6cde51fefbb81c9c44fde504cd984f24b73da3a2623a6f02135014e2d5f