Jump to content

Welcome to Beyond Windows 9 - Portal to the Future
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. If you already have an account, login here - otherwise create an account for free today!


Photo

"BART Ransomware"


  • Please log in to reply
1 reply to this topic

#1
Snuffy

Snuffy

    Senior Global Moderator

  • Global Moderator
  • 15,038 posts

Overview

The actors behind Dridex 220 and Locky Affid=3 have introduced a new ransomware called “Bart”. They are using the RockLoader malware to download Bart over HTTPS. Bart has a payment screen like Locky but encrypts files without first connecting to a command and control (C&C) server.

 

Analysis

On June 24, Proofpoint researchers detected a large campaign with .zip attachments containing JavaScript code. If opened, these attachments download and install the intermediary loader RockLoader (previously discovered by Proofpoint and used with Locky), which in turn downloads the new ransomware called “Bart”. The messages in this campaign had the subjects "Photos” with the attachment "photos.zip", "image.zip", "Photos.zip", "photo.zip", "Photo.zip", or "picture.zip." The zip files contained JavaScript file such as "PDF_123456789.js."

 

To alert the victim that they are infected and their files are encrypted, this ransomware creates two types of files, similar to many other types of ransomware. Specifically, it drops a recover.txt into many folders and replaces the Desktop background with recover.bmp, as shown in Figure 2.

bart-2.png

Figure 2: Desktop background is replaced with the recover.bmp file

 

bart-3.png

Prior to writing the “recover” files, the malware determines the user’s system language. It has translations available in Italian, French, German, and Spanish. The malware also uses the system’s language to avoid infecting systems of Russian, Ukrainian, and Belorussian users. This first campaign appears to largely be targeting US interests but, given the global nature of Locky and Dridex targeting and the available translations for the recovery files, we do not expect Bart to remain this localized.

 

Figure 4: Bart does not run if it determines the user’s system language is Russian, Ukrainian, or Belorussian and checks a few other languages, likely in order to determine the language in which to write the ransom note.

 

After encryption, a “.bart.zip” extension is appended to the encrypted files. From cursory inspection, these files are encrypted Zip archives. The list of file extensions that Bart encrypts includes:

.123 | .3dm | .3ds | .3g2 | .3gp | .602 | .aes | .ARC | .asc | .asf | .asm | .asp | .avi | .bak | .bat | .bmp | .brd | .cgm | .cmd | .cpp | .crt | .csr | .CSV | .dbf | .dch | .dif | .dip | .djv | .djvu | .DOC | .docb | .docm | .docx | .DOT | .dotm | .dotx | .fla | .flv | .frm | .gif | .gpg | .hwp | .ibd | .jar | .java | .jpeg | .jpg | .key | .lay | .lay6 | .ldf | .m3u | .m4u | .max | .mdb | .mdf | .mid | .mkv | .mov | .mp3 | .mp4 | .mpeg | .mpg | .ms11 | .MYD | .MYI | .NEF | .odb | .odg | .odp | .ods | .odt | .otg | .otp | .ots | .ott | .p12 | .PAQ | .pas | .pdf | .pem | .php | .png | .pot | .potm | .potx | .ppam | .pps | .ppsm | .ppsx | .PPT | .pptm | .pptx | .psd | .rar | .raw | .RTF | .sch | .sldm | .sldx | .slk | .stc | .std | .sti | .stw | .svg | .swf | .sxc | .sxd | .sxi | .sxm | .sxw | .tar | .tbk | .tgz | .tif | .tiff | .txt | .uop | .uot | .vbs | .vdi | .vmdk | .vmx | .vob | .wav | .wb2 | .wk1 | .wks | .wma | .wmv | .xlc | .xlm | .XLS | .xlsb | .xlsm | .xlsx | .xlt | .xltm | .xltx | .xlw | .zip

 

The ransom note urges the user to visit a payment portal in order to pay 3 bitcoins (just under $2000 at current exchange rates). The payment portal is similar to the one used by Locky, shown in Figures 5 and 6 below. Visually, only the title “Decryptor Bart” is new, where the title was “Locky Decryptor” before. While the payment portals for Locky and Bart are visually identical, the ransomware code is largely unique from Locky.

 

Currently we are still investigating the remaining technical details of how Bart works. It does not appear to have any network communication mechanism with a command and control server. Instead, the necessary information about infected machine is likely passed to the payment server in the URL “id” parameter. The malware is using the open source WProtect for code virtualization.

 

In summary, the attributes so far linking the Bart ransomware with the actors distributing Dridex 220 and Locky Affid=3 include:

  • Same email distribution mechanism (email subjects, email body, zipped-JavaScript attachments downloading RockLoader which further downloads the final payload)
  • Ransom message style similar to Locky
  • Payment portal style is the same as that used by Locky
  • The RockLoader server hosting the Bart payload was also found hosting Locky affid 3 (MD5: 3d2607a7b5519f7aee8ebd56f2a65021) and Dridex 220 (MD5: ed4191e07f49bbe60f3c00a0b74ec571).
  • Some amount of code sharing/similarity between Locky and Bart, for example in the code that sets the user’s Desktop background

Conclusion

While we are still investigating the technical details of this new ransomware, the connections between Bart and Dridex/Locky are significant. Because Bart does not require communication with C&C infrastructure prior to encrypting files, however, Bart may be able to encrypt PCs behind corporate firewalls that would otherwise block such traffic. Thus, organizations need to ensure that Bart is blocked at the email gateway using rules that block zipped executables. We will continue to monitor and analyze Bart as additional campaigns and details emerge.

 

Source for Article

https://www.proofpoi...ridex-and-Locky


  • volvo, dave, cognizione and 15 others like this

PM07fvlP.png


#2
cognizione

cognizione

    T.A.A.B # 2

  • Administrators
  • 7,520 posts

 

PhishMe Q1 2016 Malware Review

 

Malware ReviewDuring the first quarter of 2016, the PhishMe Intelligence team generated 612 Active Threat Reports detailing waves of phishing emails that delivered malware to victims around the world each day. What stood out the most was the proliferation of encryption ransomware. It has grown to become the most common type of malware utilized through soft targeting and massively distributed attacks.      http://phishme.com/


  • Snuffy, volvo, dave and 5 others like this

tGX16tl.png




"Live as if you were to die tomorrow. Learn as if you were to live forever."



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users