Het verbaast me dat een zoekopdracht naar Cryptolocker zowel op het forum als op de nieuwsberichten van de site nog geen hits oplevert.
Van mijn collega's in Amerika kreeg ik al een dag of 10 geleden wat angstige geluiden te horen en sinds gisteren heb ik een schokkend aantal bevriende bedrijven hier in .nl gezien die zijn getroffen door deze Ransomware.
Velen hebben de ransom betaald, maar (anders dan de berichten uit de VS) niet iedereen krijgt hiermee z'n bestanden terug.
Anders dan al die andere nep-ransomware van de laatste jaren die de bestanden van een gebruiker "verstopt" en voor een tweaker heel makkelijk te fixen is, is deze Ransomware zeer serieus: bestanden worden daadwerkelijk versleuteld en als je niet de $300 (! er zijn ook $100 varianten) ransom betaalt, ben je daadwerkelijk de pineut. Er wordt nl een publieke en private 2048-bits RSA key gebruikt, en tenzij je bij de NSA werkt, ga je die bestanden dus verloren moeten beschouwen.
Ik knip-plak hier onder een Engelstalige post die een goede samenvatting geeft.
Het lijkt me handig om deze thread te gebruiken om eventuele aanvullende informatie over deze relatief nieuwe en verrassend succesvolle bedreiging te verzamelen.
Knip-plak van Reddit:
Vectors: It's largely being spread via email attachments claiming to be a dispute notification, though members of the Zeus botnet have had the virus pushed to them directly. The virus is totally functional regardless of UAC or whether the logged in user is a local administrator, and has been reported on WinXP through 7 64-bit. No infections on 8 reported yet but that may be a market share thing, especially since MSE has proven ineffective at preventing the virus.
Variants: There is a version that demands $100 and a version that demands $300. No other variants reported at the time of this writing.
Payload: The virus stores a public RSA 2048-bit key in the local registry, and goes to a C&C server for a private key which is never stored. The technical nuts and bolts have been covered by Fabian from Emsisoft. It will use a mix of RSA 2048-bit and AES 256-bit encryption on files matching these masks:
*.odt, *.ods, *.odp, *.odm, *.odc, *.odb, *.doc, *.docx, *.docm, *.wps, *.xls, *.xlsx, *.xlsm, *.xlsb, *.xlk, *.ppt, *.pptx, *.pptm, *.mdb, *.accdb, *.pst, *.dwg, *.dxf, *.dxg, *.wpd, *.rtf, *.wb2, *.mdf, *.dbf, *.psd, *.pdd, *.eps, *.ai, *.indd, *.cdr, ????????.jpg, ????????.jpe, img_*.jpg, *.dng, *.3fr, *.arw, *.srf, *.sr2, *.bay, *.crw, *.cr2, *.dcr, *.kdc, *.erf, *.mef, *.mrw, *.nef, *.nrw, *.orf, *.raf, *.raw, *.rwl, *.rw2, *.r3d, *.ptx, *.pef, *.srw, *.x3f, *.der, *.cer, *.crt, *.pem, *.pfx, *.p12, *.p7b, *.p7c
It will also access mapped network drives that the current user has write access to and encrypt those.
It is worth mentioning that by the time the notification pops up, it's already encrypted everything. It's silent until the job is done.
Many antiviruses have been reported as not catching the virus until it's too late, including MSE, Trend Micro WFBS, Eset, and Kaspersky. They can further complicate matters by reverting registry changes and removing the executables, leaving the files behind without a public or private key. Releasing the files from quarantine does work, as does releasing the registry keys added and downloading another sample of the virus.
What's notable about this virus, and this is going to lead to a lot of tough decisions, is that paying them to decrypt the files actually does work, so long as their C&C server is up. They withdraw the money from the GreenDot MoneyPak manually and then push a notification for the infected machine to call home for the private key again, which it uses to decrypt. It takes a long time to decrypt, at the rate of roughly 5GB/hr based on forum reports. The virus uses the registry to maintain a list of files and paths, so not moving the files around is vital to decryption if you are paying them.
Also notable is that the timer it gives you to pay them does appear to be legitimate, as multiple users have reported that once the timer ran out, the program uninstalled itself. Reinfecting the machine does not bring a new timer.
Due to the nature of the encryption, brute-forcing a decrypt is essentially impossible for now.
Removal: Removing the virus itself is trivial, but no antivirus product (or any product, for that matter), will be able to decrypt the files until the private key is found.
File Recovery: There are only a handful of options for recovering encrypted files, and they all rely on either having System Restore/VSS turned on or having a backup disconnected from the infected machine. Backup solutions like Carbonite are no good against this as they will commit the encrypted files to the cloud. Using the "Previous Versions" tab of the file properties is a cheap test, and has had mixed results. Using ShadowExplorer on Vista-8 will give you a much easier graphical frontend for restoring large amounts of files at once (though this will not help with mapped drives, you'd need to run it on the server in that case). Undelete software doesn't work as it encrypts the files in place on the hard drive, there is no copying going on. The big takeaway is that cold-storage backups are good, and they will make this whole process laughably easy to resolve.
Forecast: The reports of infections have risen almost exponentially over the last week every single day. This virus is really ugly, really efficient, and really hard to stop until it's too late. It's also very successful in getting people to pay, which funds the creation of a new variant that plugs what few holes have been found. I don't like where this is headed.
Van mijn collega's in Amerika kreeg ik al een dag of 10 geleden wat angstige geluiden te horen en sinds gisteren heb ik een schokkend aantal bevriende bedrijven hier in .nl gezien die zijn getroffen door deze Ransomware.
Velen hebben de ransom betaald, maar (anders dan de berichten uit de VS) niet iedereen krijgt hiermee z'n bestanden terug.
Anders dan al die andere nep-ransomware van de laatste jaren die de bestanden van een gebruiker "verstopt" en voor een tweaker heel makkelijk te fixen is, is deze Ransomware zeer serieus: bestanden worden daadwerkelijk versleuteld en als je niet de $300 (! er zijn ook $100 varianten) ransom betaalt, ben je daadwerkelijk de pineut. Er wordt nl een publieke en private 2048-bits RSA key gebruikt, en tenzij je bij de NSA werkt, ga je die bestanden dus verloren moeten beschouwen.
Ik knip-plak hier onder een Engelstalige post die een goede samenvatting geeft.
Het lijkt me handig om deze thread te gebruiken om eventuele aanvullende informatie over deze relatief nieuwe en verrassend succesvolle bedreiging te verzamelen.
Knip-plak van Reddit:
Vectors: It's largely being spread via email attachments claiming to be a dispute notification, though members of the Zeus botnet have had the virus pushed to them directly. The virus is totally functional regardless of UAC or whether the logged in user is a local administrator, and has been reported on WinXP through 7 64-bit. No infections on 8 reported yet but that may be a market share thing, especially since MSE has proven ineffective at preventing the virus.
Variants: There is a version that demands $100 and a version that demands $300. No other variants reported at the time of this writing.
Payload: The virus stores a public RSA 2048-bit key in the local registry, and goes to a C&C server for a private key which is never stored. The technical nuts and bolts have been covered by Fabian from Emsisoft. It will use a mix of RSA 2048-bit and AES 256-bit encryption on files matching these masks:
*.odt, *.ods, *.odp, *.odm, *.odc, *.odb, *.doc, *.docx, *.docm, *.wps, *.xls, *.xlsx, *.xlsm, *.xlsb, *.xlk, *.ppt, *.pptx, *.pptm, *.mdb, *.accdb, *.pst, *.dwg, *.dxf, *.dxg, *.wpd, *.rtf, *.wb2, *.mdf, *.dbf, *.psd, *.pdd, *.eps, *.ai, *.indd, *.cdr, ????????.jpg, ????????.jpe, img_*.jpg, *.dng, *.3fr, *.arw, *.srf, *.sr2, *.bay, *.crw, *.cr2, *.dcr, *.kdc, *.erf, *.mef, *.mrw, *.nef, *.nrw, *.orf, *.raf, *.raw, *.rwl, *.rw2, *.r3d, *.ptx, *.pef, *.srw, *.x3f, *.der, *.cer, *.crt, *.pem, *.pfx, *.p12, *.p7b, *.p7c
It will also access mapped network drives that the current user has write access to and encrypt those.
It is worth mentioning that by the time the notification pops up, it's already encrypted everything. It's silent until the job is done.
Many antiviruses have been reported as not catching the virus until it's too late, including MSE, Trend Micro WFBS, Eset, and Kaspersky. They can further complicate matters by reverting registry changes and removing the executables, leaving the files behind without a public or private key. Releasing the files from quarantine does work, as does releasing the registry keys added and downloading another sample of the virus.
What's notable about this virus, and this is going to lead to a lot of tough decisions, is that paying them to decrypt the files actually does work, so long as their C&C server is up. They withdraw the money from the GreenDot MoneyPak manually and then push a notification for the infected machine to call home for the private key again, which it uses to decrypt. It takes a long time to decrypt, at the rate of roughly 5GB/hr based on forum reports. The virus uses the registry to maintain a list of files and paths, so not moving the files around is vital to decryption if you are paying them.
Also notable is that the timer it gives you to pay them does appear to be legitimate, as multiple users have reported that once the timer ran out, the program uninstalled itself. Reinfecting the machine does not bring a new timer.
Due to the nature of the encryption, brute-forcing a decrypt is essentially impossible for now.
Removal: Removing the virus itself is trivial, but no antivirus product (or any product, for that matter), will be able to decrypt the files until the private key is found.
File Recovery: There are only a handful of options for recovering encrypted files, and they all rely on either having System Restore/VSS turned on or having a backup disconnected from the infected machine. Backup solutions like Carbonite are no good against this as they will commit the encrypted files to the cloud. Using the "Previous Versions" tab of the file properties is a cheap test, and has had mixed results. Using ShadowExplorer on Vista-8 will give you a much easier graphical frontend for restoring large amounts of files at once (though this will not help with mapped drives, you'd need to run it on the server in that case). Undelete software doesn't work as it encrypts the files in place on the hard drive, there is no copying going on. The big takeaway is that cold-storage backups are good, and they will make this whole process laughably easy to resolve.
Forecast: The reports of infections have risen almost exponentially over the last week every single day. This virus is really ugly, really efficient, and really hard to stop until it's too late. It's also very successful in getting people to pay, which funds the creation of a new variant that plugs what few holes have been found. I don't like where this is headed.
:strip_icc():strip_exif()/u/67947/crop5f66512609d8b_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/198189/crop67ecf5f08705a_cropped.jpg?f=community)
:strip_icc():strip_exif()/u/403099/CPU.jpg?f=community)
:strip_icc():strip_exif()/u/149211/images.jpg?f=community)
:strip_exif()/u/62088/sp_jh2.gif?f=community)
/u/507029/crop56967733a9fb9_cropped.png?f=community)
:strip_exif()/u/538238/3019486021_1_3_iqw5re9p-3d98cba.gif?f=community)
:strip_exif()/u/146978/Kirby_run_anim.gif?f=community)
/u/36103/avatar_60.png?f=community){kind=avatar}
)
:strip_icc():strip_exif()/u/6986/crop61d2b90312cbc_cropped.jpg?f=community)
:strip_icc():strip_exif()/u/64029/crop5b4e6ed3481f4_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/140070/kalief.jpg?f=community)
/u/423290/crop60af527613c96_cropped.png?f=community)
:strip_icc():strip_exif()/u/269674/Tux2.jpg?f=community)
/u/234056/stampedeicon.JPG?f=community)
:strip_icc():strip_exif()/u/427774/rsz_316963.jpg?f=community)
/u/113601/crop5e3f183d640f8_cropped.png?f=community)
