Friday , July 12 2024
coding

EXCLUSIVE
Analysis of 3 Ransomware Threats Active Right Now

Three emerging threats will be discussed below, along with how sandbox analysis can be utilized to detect them proactively.

Lockbit Ransomware:

CVE-2024-5910
Critical Vulnerability Threatens Palo Alto Networks’ Expedition

Palo Alto Networks has issued a critical security advisory outlining numerous vulnerabilities across its product lines, such as PAN-OS, Cortex...
Read More
CVE-2024-5910  Critical Vulnerability Threatens Palo Alto Networks’ Expedition

Vulnerabilities in GitLab Allows Attackers to Execute Unauthorized Pipelines

GitLab has issued a warning about a serious vulnerability in its GitLab Community and Enterprise editions. This vulnerability allows attackers...
Read More
Vulnerabilities in GitLab Allows Attackers to Execute Unauthorized Pipelines

Adobe Issues Critical Security Patches for Various Products

Adobe released security updates to fix several vulnerabilities in their software. These vulnerabilities could be used by cyber attackers to...
Read More
Adobe Issues Critical Security Patches for Various Products

CISA Warns Hacker Use OS Command Injection Vulnerabilities to Compromise Systems

OS command injection vulnerabilities are a preventable type of weakness in software. Manufacturers can eliminate them by taking a secure...
Read More
CISA Warns Hacker Use OS Command Injection Vulnerabilities to Compromise Systems

Pakistan allows spy agency to intercept phone messages, calls

The Pakistan Ministry of Information Technology and Telecommunication has given permission to the Inter-Services Intelligence (ISI) to intercept citizens’ phone...
Read More
Pakistan allows spy agency to intercept phone messages, calls

Citrix Issues Critical Security Advisory for NetScaler

Citrix has warned users about severe vulnerabilities in their widely-used NetScaler products. These vulnerabilities, known as CVE-2024-6235 and CVE-2024-6236, could...
Read More
Citrix Issues Critical Security Advisory for NetScaler

(CVE-2024-38080, CVE-2024-38112)
Microsoft July Patch Tuesday fixes 142 flaws, 4 zero-days

Microsoft's July 2024 Patch Tuesday includes security updates for 142 flaws, including two zero-days that are actively exploited and two...
Read More
(CVE-2024-38080, CVE-2024-38112)  Microsoft July Patch Tuesday fixes 142 flaws, 4 zero-days

EXCLUSIVE
Analysis of 3 Ransomware Threats Active Right Now

Three emerging threats will be discussed below, along with how sandbox analysis can be utilized to detect them proactively. Lockbit...
Read More
EXCLUSIVE  Analysis of 3 Ransomware Threats Active Right Now

AVAST RELEASED DECRYPTOR FOR DONEX RANSOMWARE

Avast researchers found a security flaw in the DoNex ransomware and its previous versions, which allowed them to create a...
Read More
AVAST RELEASED DECRYPTOR FOR DONEX RANSOMWARE

Critical Security Advisory for Apache CloudStack

The Apache Software Foundation has warned about two serious security issues (CVE-2024-38346 and CVE-2024-39864) in Apache CloudStack, a popular open-source...
Read More
Critical Security Advisory for Apache CloudStack

The Lockbit ransomware is a major cybersecurity threat that appeared in 2019. It works as Ransomware-as-a-Service (RaaS), where affiliates use its software to carry out attacks. The Royal Mail was one of its main targets, and the attackers demanded an exceptionally high ransom of $80 million.

Lockbit ransomware uses the AES encryption algorithm to encrypt files, and then it encrypts the AES key using the RSA algorithm. This double encryption makes it very difficult for victims to recover their data without the decryption key.

The Lockbit ransomware has consistently evolved, with the most recent version being Lockbit v3, also known as Lockbit Black.

Despite a coalition of law enforcement agencies dismantling its infrastructure in early 2024, Lockbit has now resumed its operations.

Detecting and Analyzing LockBit Black Ransomware in a Sandbox:

Lockbit Ransomware:The Lockbit ransomware is a major cybersecurity threat that appeared in 2019. It works as Ransomware-as-a-Service (RaaS), where affiliates use its software to carry out attacks. The Royal Mail was one of its main targets, and the attackers demanded an exceptionally high ransom of $80 million. Lockbit ransomware uses the AES encryption algorithm to encrypt files, and then it encrypts the AES key using the RSA algorithm. This double encryption makes it very difficult for victims to recover their data without the decryption key. Before encrypting the data, the malware steals all the information from the infected computers, increasing the extortion. The Lockbit group has a website where they list their victims. They pressure companies to pay a ransom. If the victims refuse, their stolen data is published. The Lockbit ransomware has consistently evolved, with the most recent version being Lockbit v3, also known as Lockbit Black. Despite a coalition of law enforcement agencies dismantling its infrastructure in early 2024, Lockbit has now resumed its operations. A recent attack involved sending phishing emails using the Phorpiex botnet. The malware was hidden in the email attachments. Detecting and Analyzing LockBit Black Ransomware in a Sandbox: To avoid a LockBit infection, we can proactively analyze all suspicious files, including email attachments, in a sandbox. As part of the analysis, we can observe: CMSTMLUA process that performs privilege escalation, allowing the ransomware to gain higher-level access to the system. The desktop wallpaper change is a common tactic ransomware operators use to notify victims of compromised systems. A ransom note file containing instructions and Tor URLs for communicating with the attackers. The sandbox provides a conclusive verdict, classifying the analyzed file as exhibiting malicious activity.
Analysis of the LockBit 3.0 ransomware in the ANY.RUN sandbox

To avoid a LockBit infection, we can proactively analyze all suspicious files, including email attachments, in a sandbox.

As part of the analysis, we can observe:

  • CMSTMLUA process that performs privilege escalation, allowing the ransomware to gain higher-level access to the system.
    The desktop wallpaper change is a common tactic ransomware operators use to notify victims of compromised systems.
    A ransom note file containing instructions and Tor URLs for communicating with the attackers.

The sandbox provides a conclusive verdict, classifying the analyzed file as exhibiting malicious activity.

Bluesky Ransomware:

The BlueSky ransomware, detected in Q2 of 2022, is still a major cybersecurity threat. It targets the Windows multithreading architecture to encrypt files faster. This harmful software uses advanced encryption techniques with the ChaCha20 algorithm. It can also spread to other devices on the same network.

After encrypting the files, the ransomware changes their names by adding the .bluesky extension. It also creates a ransom instruction file, instructing victims to pay a ransom by accessing a page on Tor.

Detecting and Analyzing BlueSky Ransomware in a Sandbox:

Despite BlueSky’s anti-analysis functionality, we can easily expose it by uploading its sample to a free malware sandbox like ANY.RUN, which offers a safe virtual environment for detonating it.

See this analysis session for more details.

Analysis of the Bluesky ransomware in the ANY.RUN sandbox

Analysis of the Bluesky ransomware in the ANY.RUN sandbox:

The service instantly detects the malware and notifies us about its presence by adding the corresponding tags “bluesky” and “ransomware”. It also lists the activities carried out by the program including:

File renaming.

Creation and dropping of a ransom note containing instructions on how to decrypt the locked files. Thanks to its interactivity, the sandbox lets us open this note manually and read its contents.

Analysis also reveals that the note contains a TOR network URL, which the victim is instructed to visit to make the ransom payment.

After analysis is complete, we receive a detailed report with all the important information gathered during the file execution, including indicators of compromise.

Beast Ransomware:

Beast ransomware, also known as Monster ransomware, emerged in March 2022. It is built on the Delphi programming language and has the ability to attack both Windows and Linux systems.

The malware doesn’t affect users in CIS countries, indicating that the creators might be from that region. The Beast ransomware uses a high-level encryption method and also archives the encrypted files.

The malware is mainly spread through email attachments and links, taking advantage of people’s vulnerability to phishing attacks. Despite being a new type of ransomware, Beast has the potential to become a serious and widespread threat, similar to LockBit.

Detecting and Analyzing Beast Ransomware in a Sandbox:

By running suspicious files and URLs in a sandbox, we can easily expose Beast and other malware.

Analysis of the Beast ransomware in ANY.RUN sandbox

Consider this analysis session.

Some of the Beast activities detected by the service include:

Installation of a mutex characteristic of the Beast malware.
Attempt to obtain the host’s IP address.
Connection to an external SMB server.

Analyze Suspicious Files and URLs in ANY.RUN

ANY.RUN sandbox allows you to interactively analyze malware. You can safely engage with files and links in a virtual environment to investigate the full extent of each threat.

The service finds and lists all activities in network traffic, registry, file system, and processes, and extracts signs of compromise.

Source: cybersecuritynews.com

Check Also

key

Malware Researchers detect 29 New Ransomwares in May

In May, cybersecurity experts found 29 new ransomware types. These malicious programs are a big …

Leave a Reply

Your email address will not be published. Required fields are marked *