Security For My Life

Message in Russian, you need to mail vipasana4@aol.com to get your files back

твои файлы зашифрованы, если хочешь
все вернуть, отправь 1 зашифрованный файл на эту почту:

vipasana4@aol.com

ВНИМАНИЕ!!! у вас есть 1 неделя что-бы написать мне на почту, по прошествии
этого срока расшифровка станет не возможна!!!!

Your files are encrypted, if you want them all returned,
send 1 encrypted file to this email:

vipasana4@aol.com

ATTENTION!!! you have 1 week to send the email, after
this deadline decryption will not be possible !!!!

.r3d, .rwl, .rx2, .p12, .sbs, .sldasm, .wps, .sldprt, .odc, .odb, .old, .nbd, .nx1, .nrw, .orf, .ppt, .mov, .mpeg, .csv, .mdb, .cer, .arj, .ods, .mkv, .avi, .odt, .pdf, .docx, .gzip, .m2v, .cpt, .raw, .cdr, .cdx, .1cd, .3gp, .7z, .rar, .db3, .zip, .xlsx, .xls, .rtf, .doc, .jpeg, .jpg, .psd, .zip, .ert, .bak, .xml, .cf, .mdf, .fil, .spr, .accdb, .abf, .a3d, .asm, .fbx, .fbw, .fbk, .fdb, .fbf, .max, .m3d, .dbf, .ldf, .keystore, .iv2i, .gbk, .gho, .sn1, .sna, .spf, .sr2, .srf, .srw, .tis, .tbl, .x3f, .ods, .pef, .pptm, .txt, .pst, .ptx, .pz3, .mp3, .odp, .qic, .wps

'Read and change all your data on the websites you visit'

CSGODouble Theme Changer
CS:GO Double Withdraw Helper
Csgodouble AutoGambling Bot
Improved CSGODouble

• More ransomware
• More misuse of the word 'CryptoLocker' (this ransomware died somewhere in 2014)
• More malware
• More misspellings of malware ('mallware', 'maleware', etc.)
• More IoT devices (Internet of Things)
• More ransomware or other malware for IoT devices
• More database/company breaches
• More spam, phishing, etc.
• More (ATM) skimming
• More nation-state malware
• More governments spying on their citizens
• More privacy concerns
• ...

Kan du kontrollera den bifogade filen och låt mig veta vad du tycker? Tack

I just got this document, could you please check it and get back to me? Thanks

IP location: United States (VirusTotal)

Ole10Native is in fact a VBS file

Clicking the icon, warning message from Word

Decoy message

PowerShell download & running the malware

As you can see, it has covered quite a lot of extensions. Nathan Scott from Bleeping Computer provided an image with a great explanation on what the script does:

(Source)

In the version I saw, the PowerShell scripts were slightly different, in fact an 'improved version'.

After encrypting all your files, it will drop an HTML file (named DECRYPT_INSTRUCTION.html) on the root of all your folders which contains the following message:

Ransom message - you may need to pay up to $ 1000

It generates your #UUID by the following simple PowerShell command:

Get-wmiobject Win32_ComputerSystemProduct UUID

When visiting said Onion (Tor) link:

Unlock message

• Don't open attachments from unknown senders - ever.
• Install an antivirus and keep it up-to-date and running. Enable the option to scan Compressed Files. 
• Consider disabling Windows Script Host. You can use my tool, Rem-VBSworm with option D for example.
• Alternatively, you can install Analog X's Script Defender, which will block these scripts (JS, VBS, ...) as well.
• Consider disabling PowerShell if you don't need or use it. There are two possible options:
  
  
  
  Note that if you have a company laptop, you should inform with your network administrator first.
• Improve security for your Microsoft Office package. (Word, Excel, ...)
  This means disabling ActiveX, disabling macros and blocking external content. Useful links:
  Enable or disable ActiveX controls in Office documents
  Enable or disable macros in Office documents
  Block or unblock external content in Office documents
• As with all ransomware cases: take backups!

• Identify and kill malicious processes (use Task Manager for example). In this specific case:
  winword.exe, wscript.exe, powershell.exe
• Run a full scan with your installed antivirus product.
• Run a full scan with another antivirus and/or antimalware product.
• In a company: unplug your network cable & warn your network administrator immediately!

Just received my 1st-ever digitally signed piece of spam. The ribbon is bound to entice someone 2 click on the email pic.twitter.com/470TpdaPDE

— Robert (Роберт) (@RobertIdAu) November 9, 2015

Spam but digitally signed

Signature details. S/MIME message format

IP location: Singapore (VirusTotal)

"recalculation.zip" attached

Hello
This recalculation of payments for the last month.
I remind you of your debt 3148,48 AUD.
Please pay as soon as possible.

Part of the JavaScript

Download

Run

IP location: Korea (VirusTotal)

Functions in our DLL file

Decoy PDF document (not malicious)

• Sender's end: Create an SPF record, as to prevent sender address forgery. More on SPF here.
• Receiver's end: Turn on SPF checking on your mailserver.
• If possible, turn on full support for DMARC. More on DMARC here.
• Check that only your mailserver may access the WAN (or RED) on port 25. Configure this in your firewall.
• Check that you use strong passwords for your Domain Controller server(s). 
• Check that antivirus is installed, up-to-date and running on all workstations. (if applicable)
• If not needed, you can disable Windows Script Host (WSH), as it's needed for JavaScript to run locally. Read how to do that here. 

• Don't open attachments from unknown senders - ever.
• Install an antivirus and keep it up-to-date and running. Enable the option to scan Compressed Files. 
• Preferably, see that your antivirus has a firewall as well, to prevent unauthorised access.
• Consider disabling Windows Script Host. You can use my tool, Rem-VBSworm with option D for example.
• Alternatively, you can install Analog X's Script Defender, which will block these scripts (JS, VBS, ...) as well.

• Look for suspicious Run keys (find locations here) and delete the associated file(s).
  In our case, all files were dropped in the %TEMP% folder. Also, don't forget to look for rundll32.exe processes, as the payload was a DLL file. More information on rundll32 here.
• Run a full scan with your installed antivirus product.
• Run a full scan with another antivirus and/or antimalware product.
• In a company: warn your network administrator immediately!

In computing, the Executable and Linkable Format (ELF, formerly called Extensible Linking Format) is a common standard file format for executables, object code, shared libraries, and core dumps.
Source

(Source)

Sending of large SYN packets (Source)

Malware running and its related files

(Source)

(Source)

You can also see 8.8.8.8, Google's DNS server and likely used to resolve the C&C domains

Connections to wangzongfacai.com and dsaj2a1.org

3000uc.com, another familiar player - and again dsaj2aX

Just a visual representation of detection difference. Read this for info.

• Identify malicious processes: run ps ef (ps stands for process status) to see which processes are running. Alternatively, you can use top or again ps with other parameters, for example ps ej or ps aux for a more complete, human readable table. Look for processes with random names; in our example it started with S90 and random letters afterwards, linked to files with all random names, as is the case in our example malware named bmtsfnlgxu.
  
  Once you've identified the malicious process(es), you can use the following command to find related files as well: for pid in $(ps -C -o pid=); do ls -la /proc/$pid/fd; done
  Where is the name of the suspicious process. This command will display any open, related files. For example, for bmtsfnlgxu it would be:
  for pid in $(ps -C bmtsfnlgxu -o pid=); do ls -la /proc/$pid/fd; done

• Identify malicious files: look for newly created files in /etc/init.d/, /boot/ and /usr/bin/. Again, look for files with random names. You may also use the command ls -lat | head to view recently changed files.
  
  Check your crontab (/etc/crontab). Delete the malicious cron jobs, more specifically the cron.hourly jobs and in the case of Xor.DDoS they will be the following:
  
  */3 * * * * root /etc/cron.hourly/cron.sh
  */3 * * * * root /etc/cron.hourly/udev.sh
  
  Delete these two lines from your crontab. Don't forget to save. Delete the related files, located in /etc/cron.hourly. In our case, their content was as follows:
  
  cron.sh

• Stop and kill malicious processes: identify the parent process; usually it will be the one consuming the most CPU (which you can verify using any of the earlier commands, top being the easiest). Firstly, be sure to stop the parent process and wait for the child processes to die. Use the command: kill -STOP $pid
  
  When the child processes are dead, kill the parent by using: kill -9 $pid
  Note: in case you see any other malicious processes, go through the last 2 commands again.
  
  
• Delete any leftover malicious files: locations where the malware may reside have been indicated before, but to be complete:
  

  /boot/
  /etc/init.d/
  /etc/rc.d
  /etc/rcX.d (where X is a number)
  /usr/bin/
  /lib/
  /lib/udev/udev
  /lib/udev/debug

• Use rm -rf to permanently remove a file. Be careful with this command.
• Having troubles removing a file? Are you root? If not, try killing a process or deleting a file using root by prepending sudo before your command. For example: sudo kill -STOP $pid
• Malicious process keeps coming back? Go over the steps again, but this time note down where the malware resides. Make that directory and its files unmodifiable by making use of the chattr command. For example, malware is being recreated in /usr/bin/. Use the command: chattr -R +i /usr/bin/ Then, stop the parent, wait for the children to die and kill the parent. Remove the files. Don't forget to use chattr again after you cleaned the infection. (in our example: chattr -R -i /usr/bin/)
  
  It's also possible the malware is temporarily storing files into /tmp/ while you are trying to kill its processes. When that happens, use the same chattr command on the /tmp/ directory and start over. If you are in doubt, use that chattr command on all aforementioned directories and start over. Very important: do not forget to use chattr -R -i on them afterwards!
• In rare cases, the attacker may still be connected to your box. If possible, cut the internet connection and go over the disinfection steps. If this is not possible, firstly stop SSH by entering the command:
  sudo /etc/init.d/ssh stop
  
  Then, use iptables to drop any connection to the IPs the malware is connecting to (use netstat for example, see also Diagnosis) and to drop any connection from the attacker or cybercriminal. How to do this:
  
  In our example, we learned that our C&C's were 103.25.9.228 and 103.25.9.229. Thus, type or copy/paste these 2 commands:
  iptables -A OUTPUT -d 103.25.9.228 -j DROP
  iptables -A OUTPUT -d 103.25.9.229 -j DROP
  
  To block connection(s) from the attacker (you can find the attacker's IP using netstat for example):
  iptables -A INPUT -s $attackerIP -j DROP
  
  Don't forget to save your freshly created iptables rules by using the command
  /etc/init.d/iptables save
  
  Afterwards, change all passwords. (SSH, your user, root)

• restoring from a backup 
• if the machine is virtual, restore to a previous snapshot

• Use strong passwords for SSH or use keys instead of passwords for authentication. You can read how to do that here. In the unlikely event of you not needing SSH to a particular machine, disable it on that machine by:
  sudo apt-get remove openssh-server
  
  To disable it from starting up you can use:
  update-rc.d -f ssh remove
• Don't open the incoming SSH port (default 22) to ANY, but rather restrict it to trusted IP addresses.
• For more information about safely using SSH, see: SSH: Best practices
• Use a strong firewall. In Linux there are many options, iptables is a solid choice. A good basic iptables howto can be found here. In a network or if you need to protect several machines, you may want to consider a seperate hardware appliance as your firewall/UTM/... of choice.
• Iptables can do a very decent job once properly configured. In case you want to do less manual work, I advise to check out sshguard or artillery. Both can monitor and alert you when something funky happens. In the context of our blog post, it also looks for & protects against SSH bruteforce attempts. Another application to consider is fail2ban. An additional tool is snort. For more information about these tools, refer to their pages.
• Consider using SELinux. Security-Enhanced Linux is a compulsory access control security mechanism provided in the kernel.
  
  
• Consider locking down cron jobs to only certain users. To deny all users from using cron you can use:
  echo ALL >>/etc/cron.deny
• Consider disabling remote root login. Read how to do that here.
• If you browse a lot, consider using NoScript as well.
• Keep your software and applications up-to-date, as on any system.
• Consider installing an antivirus as second opinion or at least as an additional layer. This is not a necessity but may come in handy. I recommend ClamAV.
• Don't forget to protect other appliances that may be running on *nix systems, for example your router (and nowadays, IoT devices). Upgrade the firmware as soon as possible and change the default root/admin password(s). Install updates/patches for your particular firewall/UTM/... as well.
• For even more (general) tips on hardening your Linux system (not against Xor.DDoS in particular):
  20 Linux Server Hardening Security Tips

• Every ELF malware made by the ChinaZ actor or group (Linux/ChinaZ.DDoS, Linux/Kluh, ...)
• Linux/Aes.DDoS (Dofloo, MrBlack)
• Linux/Bash0day (Shellshock, Bashdoor)
• Linux/BillGates (Gates.B)
• Linux/Elknot (DnsAmp)
• Linux/GoARM (Ramgo, Goram)
• Linux/IptabLes and Linux/IptabLex