The Evolution of GandCrab Ransomware

Tamas Boczan @tamas_boczan Sr. Threat Analyst Why? Why? Why? Business Model: RaaS Panel for Affiliates Mass Delivery Methods

• Email attachments - Javascript - Doc - Encrypted doc • Drive- by download Delivery: RDP, Exploits Payload: Starting Point

Data collection

• System Info • External IP • AV? Payload: Starting Point

Data collection Connect Home

• System Info • nslookup • External IP • AV? Payload: Starting Point

Data collection Connect Home Preparation

• System Info • nslookup • Kill Processes • External IP • AV? Payload: Starting Point

Data collection Connect Home Preparation Encryption

• System Info • nslookup • Kill Processes • AES • External IP • *.GDCB • AV? Payload: Starting Point

Data collection Connect Home Preparation Encryption Post-Infection

• System Info • nslookup • Kill Processes • AES • Shadow Copies • External IP • *.GDCB • AV? Feb 28: Europol decryptor

Data collection Connect Home Preparation Encryption Post-Infection

• System Info • nslookup • Kill Processes • AES • Shadow Copies • External IP • *.GDCB • AV? 7 days later: v2

Data collection Connect Home Preparation Encryption Post-Infection

• System Info • nslookup • Kill Processes • AES • Shadow Copies • External IP • *.CRAB • AV? • Kernel-AV 7 weeks later: v3

Post-Infection

• Shadow Copies • Wallpaper v4

Data collection Connect Home Preparation Encryption Post-Infection

• System Info • nslookup • Kill Processes • AES • Shadow Copies • External IP • Salsa • Wallpaper • AV? • *.KRAB • Self-removal • SMB shares v4.1

Data collection Connect Home Preparation Encryption Post-Infection

• System Info • WPress hacks • Kill Processes • Salsa • Shadow Copies • AV? • URL generation • *.KRAB • Wallpaper • SMB shares • Self-removal Vaccine: Jul 13

4 d 2d

1d Zero day details

4 d 2d

1d 13 d

• BSOD, no RCE • Full disclosure, not used • Why? - Retaliation - Overestimated impact

• Probably just fuzzed it v5

Data collection Connect Home Preparation Encryption Post-Infection

• System Info • WPress hacks • Kill Processes • Salsa • Shadow Copies • AV? • URL generation • Escalate • *.{Random} • Wallpaper • SMB shares • Self-removal v5: Maintenance

Data collection Connect Home Preparation Encryption Post-Infection

• System Info • WPress hacks • Kill Processes • Salsa • Shadow Copies • AV? • URL generation • Escalate • *.{Random} • Wallpaper • SMB shares • Self-removal Retired? What We Learned: Developer’s Profile

• > RaaS marketing skills • Project organization: > react quickly < poor quality • Exploit development capability: > implement exploits based on POCs > find simple exploit via fuzzing < can’t develop more complex RCE exploit < can’t guess impact of an exploit The Evolution of GandCrab Ransomware

Tamas Boczan @tamas_boczan Sr. Threat Analyst