The Lie of the "Retis" ransomware - How to decrypt

Its two days to christmas and there is no petrol to move around and I have been grounded by my wife for staying out late (10pm), so i stay at home and play with my daughter (Nicole). At the exact point she slept off, i got a threat intelligence report about a new ransomware dubbed "Retis Ransomware". Bored at home, i decided to have a look at this new toy. I got a sample of it from hybrid-analysis and just threw it into "dnSpy" - my favorite .NET decompiler.
To my surprise, the code was not obfuscated as most malwares are usually obfuscated to prevent reverse-engineering.
I also noticed it was very selective of the type of files to encrypt and focused on documents and pictures.
I ran it within my test system and it encrypted some files and added ".crypted" extension. Unlike most disastrous ransomwares (wannacry, notpetya, badrabbit) this was a bit lax on the range of files to encrypt, and also it did not seem to delete shadow files which could be used to retrieve deleted/encrypted files.
It also displayed the ransom note below (translated to English from French)
A look at the encrypt file function (EncryptFile) shows that it makes use of a secretKey and an intialisation key (IV), which is not out of the norm, but i then noticed that these keys are actually hardcoded within the program itself at the main() function.
This alludes to the fact that a Decryption function should be somewhere within the code. There it was, and it also made use of the same keys used for encryption.
It meant that the ransomware could somehow decrypt itself. Lets look further.
A closer look at the main() function showed that the ransomware checks if there is a second argument and if that argument was same as "/dechiffre" (french meaning for "/decrypt").
Could this be how to decrypt encrypted files? I checked it out and it worked.
i have read so many "false" reports on the malware and how to remove it from systems by downloading a "special" tool to remove it. Vendors exploiting the situation to sell something.
Blogs copying other blogs "verbatim" in their reporting without validating. The ransomware lacks sophistication and does not even provide a bitcoin address to make payment.
I hope we have learnt something today. :)
Merry Xmas and a Wonderful New Year :)

Comments

Post a Comment

Popular posts from this blog

Red Teaming with Covenant and Donut

Image
Red Teaming has rapidly transitioned from Living off the Land (LotL) to Bringing Your Own Land (BYOL). It is now possible to execute .NET assemblies entirely within memory. By developing custom C#-based assemblies, attackers no longer need to rely on the tools present on the target system; they can instead write and deliver their own tools, a technique called Bring Your Own Land (BYOL).  This has led to transitions from PowerShell tools (e.g. PowerShell Empire) to frameworks targeted for .NET assemblies. {shamelessly copied from  https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html } About Covenant Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers. Covenant is an ASP.NET Core, cross-platform application that includes a web-based interface that
Read more

Pentesting Android applications

Image
Hi all, I would like to talk about the coolness of android applications. So if you want to perform a security review an android app, how will you go about it? There are so many ways to go about this, i will highlight some of the ways I use. 1) Most android applications work just like Web applications, they send out HTTP requests using POST and GET methods. So a cool thing to do is to intercept and capture these requests, make modifications and monitor responses (which can also be intercepted and modified). So how can this be done? A sweet way to achieve this is by proxying all traffic from the application on your phone through a proxy tool such as Burp Suite (coolest tool for me). Now how can you direct that phone traffic to your Burp Suite which is probably running on a laptop or system? Well, you can use a great android tool called "Proxy Droid" to direct the traffic to the IP address and port on which the burp suite is listening. You can connect them to the same wire
Read more

Covenant Task 101 - PPID Spoof Example

Image
Covenant is a great C2 tool for red teaming. I use it on most engagements as its in C# and easily extensible. This post was inspired by Rasta Mouse's Covenant 101  where he nicely described how to modify Covenant source to add a task. The purpose of this post is to leverage Rasta's post to further simplify the process especially for those new to Covenant. Ryan Cobbr, the main author of Covenant has already done a great job by adding a "Tasks" menu where an admin user can lists all tasks and modify their configurations. I will be be showing how I leveraged this in a recent engagement to bypass certain EDRs and AV behavioural signatures. Story Time Once upon a time, I was contracted to do a red teaming engagement for one of the World's leading pharmaceutical firms. Fast forward to when I crafted and had sent a neat phishing mail (embedded with a link to a malicious Word doc). Within 10 mins, about 9 users had clicked, and I had 9 grunts, however, the grunts we
Read more