anything
okay welcome everyone
my name is Robert Neumann I'm the head
of the Cyber protection operations
center at acronis
hey guys welcome everyone and I'm Albert
I'm a cyber security researcher from
acronyms
and today we would like to talk about a
specific ransomware family or should I
say trinity that's sort of a one
ransomware family that evolved and
developed over time and we would like to
present some findings around that so in
today's presentation we'd like to talk
about how it was delivered
of the challenges that we faced with
golang golang as a programming language
used in this specific ransomware family
how we solve these challenges what sort
of evolution steps the ransomware took
over its time
uh who were the victims and basically
how to prevent such ransomware cases in
this current presentation we will be not
touching on file encryption and the
initial compromise
so if you're looking at the big
ransomware picture and you go over to
Redstone db.com and look at some of the
statistics there it's clear that the
incident count is still high it's not
going down so ransomware is
staying with us for a very long time
but obviously a lot of more people want
want a piece of the pie
a lot more groups joining in or even all
the existing groups just take a
different branding different names and
basically continue the operation in
similar fashion
we also see that victims still paid the
ransomware fee which is obviously a
catalyst to this whole whole ransomware
scheme
after the colonial pipeline incident
that took place not so long ago
we feel it was sort of a turning point
uh in in ransomware investigations
because after the critical
infrastructure was attacked we saw some
arrests in in Russia and uh
the the US Government tried to go after
the the for example the r evil
rhinestone virgin family affiliates
and it was a turning point for for a
ransomware cases
and that's where our investigation
started almost like one and a half year
ago
with the specific friends on their
family called Epsilon red and over the
course of one and a half year we kept a
close eye on it how it evolved
initially it seemed that it was only a
one-off campaign but the ransomware took
a different branding different name and
sort of evolved over time
here I would just like to highlight some
of the challenges that he faced with
this family one of them obviously was a
Powershell obfuscation the family was
written in golang and we also saw some
obfuscation attempts on the binary
uh he even had some unpacked packing
routines on it and uh one of the new
things to this ransomware family was the
use of the execution Keys which would
obviously help if you would try to run
this in automated sandboxes for example
[Music]
sock or serve people here maybe the
first picture is
familiar to you I'm sure you've seen a
lot of these in Frontline investigations
so initially the ransomware is delivered
via a Powershell script that's
obfuscated and as you can see it used
some interesting casings that later the
ransomware ransomware script would try
to replace on the second screenshot and
basically that's how the Powershell
script builds up
so what sort of features these spiral
share script had obviously the casing
and the obfuscations it also employs
some interesting hidden Windows style
which would obviously hide the window
from the user
also we've seen some exclusion of
interesting folders like windows program
files obviously we don't you don't want
to encrypt those to preserve the systems
Integrity but it would also stop
processes and services related to AVS
and SQL databases
and other comments would just simply
clean up event logs from Windows even
change boot options delete Shadow copies
or even turn off Windows Defender and
change the execution policy in in
Powershell settings
let's talk about the payload so after
the Powershell script
it would
in our first case the Powershell script
would create two more power share
scripts that would later create 10 more
power share scripts so it's kind of
interesting to see how they did that and
after all these steps a payload or a
binary would be sent to the system so
this final payload is written in C and
golang
compiled using the mean GW tool we've
seen and observed some AES and RC
encryption methods in the binary and
initially it only had a very low
detection rate like 7 or even 10 to
begin with and contrary to many reports
I shouldn't say many a few reports
we've seen that some Reports say that it
had some anti-vm capabilities while
actually it didn't have any of those it
only employed the execution key to start
the payload and there's one interesting
instruction called cpuid in one of the
go functions but it was not used for any
sort of anti-vm features
uh so the binary employed packing as
well and it stripped infrastripped from
any sort of key information the
developers even go event ahead and
removed the famous goal building
formation the ID from the binary we've
seen samples video PX and back to it
later with time idea as well
with upx we come across an interesting
bug which is actually not
not a very recent but when you unpack a
sample which is
packed with upx with the default minus D
option the upx packer
basically removes The Relic section from
the payload
and you won't be able to run it for
example in a VM machine so that's why
you need to use the dash-3 products
command to preserve that that
information
more interesting things about this
payload and I would like to just give
you guys some one-on-one or 101
information on golang
so golang binaries are statically linked
which means all the necessary libraries
are inside the binary when it is
compiled which means it will be huge in
size like at least three megabytes some
cases five ten megabytes of a malicious
binary
obviously in goaling you can compile
binaries to many many platforms
and you can also embed like C or even
assembly inside of them
and golang has a wide range of support
for crypto and network libraries so
that's why it's very popular between a
developers malware developers let's see
and all these things come to you one
thing that it is difficulty reverse
engineer pulling binaries but we have
some nice tools now that are circulated
in the community and that can definitely
help you reverse goal and binaries
so what are some of the challenges with
golang binaries obviously Street
stripped binaries they don't have
sometimes
any meaningful information like symbol
names or even function names Global
variable names such and such
but there's one interesting section
called the PCL and tab
which holds plenty useful information
about The Golden binary and this is not
a section that you will find in in goal
and binaries by default but you have to
look for the structure of it inside the
our data section
if you're really curious you can go to
this link and find some information
about that structure
another thing go strings are not not
terminated which makes it really hard to
investigate and reverse
basically there are huge large string
blobs inside these binaries and only the
sequence of bytes defines each strings
so we took our favorites in this
assembler either and looked at how we
could start reversing obviously in the
early versions of Ida there was no such
support for Golden binaries and as you
can see on the first left hand side
screenshot
key functions were only displayed as sub
underscore something
and after Ida pro version 7.7 there was
huge improvements regarding this and you
can find this key option in either under
other search for PC Line tab which would
obviously help you define and look for
the structures and rename those key
functions
so you go along and reverse these golang
binaries and you start wondering whether
you end up in in Wonderland and you will
feel like Alice tumbling down the rabbit
hole starting from the entry point going
through all these go functions
going after main runtime RT zero Go
runtime main units and then finally you
end up in main main which is the real
key go function
after that obviously you need to
practice some debugging set up some
break points even do some VM snapshots
to really understand uh how the binary
Works what sort of encryption it employs
or even sometimes you need to dump
memory regions to understand the
the planes things for example to gain
that out
and we come to a section that was really
interesting to us or some findings that
were really interesting this ransomware
family uses something called cgo
and basically it's a fusion of c and
golang
so in this case
basically a go package can be built as a
shared C
library but cgo allows you to do this
the opposite way as well
so C libraries from go packages
we create it so C code can actually
reference go packages
and you would start this by issuing this
command here
but obviously that's not enough because
there's no C header and there's no C
symbols so you also need to import those
after that
one other peculiar thing about this I
think and we think
you might wonder and ask why is this
used in this ransomware family well
certain boilerplate code can be written
for example in golang
and let's say if you go on the
Underground forums and you start to look
around you might see that sometimes the
developers sell these parts of this of
these codes and later when a new player
joins the game the ransomware game they
could just buy these section of codes
and join them up and just compile the
binary so it's really allows a low entry
for these ransomware Developers
so what are the implications of this
uh in the screenshot here you can see
how you can recognize these cgo patterns
just looking at some of the functions or
in the strings
and currently we are at the stage where
malware can use or will use multiple
programming languages at the same time
but if you think about this and I'm and
I want to end my ports on a high note
what if you have a sample that's
employing C golang or even rust at the
same time so that could be something
like malware on steroids
and if this trend continues and I'm a
little bit prophesizing here I think
within one year or it might be already
that you will see malware using at least
three programming languages and
currently golang allows to
call other functions from rust for
example rust has this interface called
foreign function interface that will
allow you to call from rust to golang or
from golang to rust basically
and I'll pass it over to Robert
so another interesting thing we find in
the binary is that they were initially
using something called codivolc so this
is a directory traversal library but
they just had to use to kind of go on
all in all the directories and start
encrypting there are a couple of things
with this so initially they were using
that but later they were changing to
something called an internal Volk go
Library basically the change was due to
the the first bit earlier versions of go
the the internal library was just not
fast enough so they were relying on this
external one but after like version 1.16
there were a lot of improvements and as
you can see on the chart on the right
that the Cody Rock implementation from
Carrick is actually the the slowest so
they were adopting but I will be showing
that with some campaigns later on how
that adoption was actually taking in
place the takeaway from here is that
actually go to your world and can be a
liability because of the speed and
because this is a library we can detect
in Google binaries and that might help
some of course the library can be used
for a lot of other features but this is
some hint
and they were not stopping there with
the go binaries so there is something
called go for skate that's an
obfuscation package for for go binaries
basically it can do manipulation of
package names Global variables function
names type names method names and
strings
and on the screen you see on the right
that you would have your normal naming
convention for your procedures and your
data and then it's obfuscated so you
have already that kind of garbage and
it's just making the reversing a little
bit more challenging
with the string obfuscation this is the
kind of the only one in Goku's kit but
you can properly do and reverse there
are two different ways for doing that
either it's kind of stored as an array
or you have a function calls but
basically this is a very simplistic xor
based encryption so just like it's being
xor based it can be reversed you can
have a small python script to do that
for you so obviously the mobile routers
are being aware of this one and they
don't want to stop here because with
that restoring the original internal
strings would be just a piece of cake
for them
so instead of that okay go for usually
for something else as for encryption
so on the left you see something I'm
calling like a friendly runs over sample
actually that's more like just a random
ransomware binary which was created
in.net you can see highlighted Unicode
strings so if you can see the screen
there are strings about encryption about
email address and about a ransom Note
file name so if you have it like that in
your binary that's pretty much easy to
have like a simplistic URL rule
detecting all these for hunting and
detection it's not going to be a problem
obviously we are dealing with something
else here so in one of our variants this
is what you see in the go binary so as
Albert was explaining earlier we have
all these kind of strings concatenated
in a huge blob in go and if you put any
kind of obfuscation or encoding or
encryption on top you end up having
something like this this is just a huge
hex encoded like blob and you don't know
where the information is really starting
here what you would need to do to decode
and variety of which are the parts
so actually after after you are doing
some debugging and you see how it is
being done
it took me a little bit of a hard time
to find an area in the sample which is
actually holding two separate pieces of
strings so later these blobs will be
used by go and just kind of cut or copy
it from the big block and then the
decryption will be applied on these ones
so when we talk about
decryption they are mainly using AES at
least for now the the decryption I'll go
is consisting of a couple of go specific
goals that the strings to slice byte
which is
uh kind of working with the Big Blob
then decoding the hex then calling the
thes decryption and sometimes start
transforming things to Strings and then
depending on our specific variants or
like kind of how crazy the developers
are here they are repeating that over
like n times and I will also showcase
that later the more interesting part is
on the right side like what we end up
having us for the result of the
decryption
so in all the binaries we've been
investigating in the past one and a half
year we have seen almost exactly the the
very same strings sometimes there were
very minor uh differences but each of
these samples were containing at least
an email address
a panel or a compound key that's
specific to one one target they are
attacking the there is password for
execution for all but the very first
sample then the extension of the
encrypted files how they are going to
cool down with them then the file name
for the ransom node there are some node
template itself
or specific RSA key which is of course
always changing as per sample and then
some internal strings which are mainly
used to to replace and build up the
ransomware template and then the last
three months are just another set of
instant strings used for the
multi-threaded encryption that runs over
payload is utilizing but besides this
you don't have any other meaningful
strings in the binary they don't have a
list of file extensions because they are
encrypting all files on a specific knife
more on that later so not much to to
take and to get even these you need to
go through usually multiple layers of
AES encryption
a little bit about their own some note
templates
we are mainly dealing with two templates
because they were changing over time but
here are those specific points marked
with yellow then actually the victim
specific information is going to insert
it into the template and then you will
have this this ASCA the final Ransom
note dropped to the disk
so how this is all looking like in in
the timeline as we said it was an
investigation for about a year and a
half the initial sample was the Epsilon
gang
and it's a very interesting part of that
was not just the the usage of the
PowerShot they were using Powershell in
ransomware before and also golang wasn't
the kind of the first case
but it was more interesting that after
the very first kind of attack about
absent with Epsilon gang or an Epsilon
red no one really heard about that team
anymore no one was blogging about that
except that they were trying to link
them to certain other campaigns so in
the this very first one they were using
upx and that was just one layer of AES
they were using the go deer walk that
was the there was no execution key so if
you could just get the sample you could
run it with providing like uh
C drive argument to the main binary and
it would start encrypting your all your
files that was the panel key the The
Ransom node file name and as you can see
victims could be identified because they
were using that as the independent URL
so we were removing the sensitive
information but it was pretty much Clear
how to use or how to identify the the
victims because that was kind of plain
text and our kind of a company name
without the numbers
so after that only just a couple of
weeks later and there was another
Warrior but now we are not talking about
Epsilon anymore we are talking about
kind of a new team well some at least
people who are believing that called
Black cocaine
so it was actually the the very same
structure and very same sample so they
were rebranding just within a couple of
weeks not sure if the the timeline with
the colonial pipeline accident is is the
key here because that was also happening
last time in May so maybe they were
having some additional pressure maybe
that was kind of planned all the way
along but we haven't seen anything as
before the Epsilon red campaign but
surely we have seen what they were doing
after that here the only key change was
that they were introducing the execution
key so while the App Store that sample
could just run if you were running the
new one in a VM it would do absolutely
nothing the problem with that is that
people if they are getting any
ransomware sample for that investigation
like digital forensic and verifier and
anything like that they would be
dropping these into sandboxes and of
course a Sandbox wouldn't do anything
with that it would be just one sample
which is immediately doing nothing for
them
other than that it was just the branding
so we are talking about Black cocaine
from now on the structure is the same
the hot recover files are kind of
following the same platform pattern and
then we also have victim information but
we are redacting the email is protonmail
here
in uh kind of uh just within a couple of
days in May we were also having at least
two additional black cooking samples the
only thing to mention about that because
there was no big change here that they
were reusing the same execution key at
least like three times so they didn't
feel that that was very important to be
changed that's actually included in the
original Powershell for the execution
they were always making sure that uh
included RSA key is always different for
the victims
and then there were other changes even
within a couple of days so you could see
in the previous side if they were using
the cocaine.black with C2 domain but
then they were changing also to the
black cocaine.top and no real reason of
why they were doing that maybe kind of
just trying to kind of hide or moving
away from the old one but everything
else is pretty much the same here and we
are still talking about that it was all
happening in May with like four
campaigns then there was a just a little
bit of a bigger jump we are jumping to
same year September and we have
something called Colossus
at this point almost all the security
companies got a little bit confused The
Ransom note was still
pretty much the same so they were still
trying to sometimes do the correlation
between the previous kind of Brands and
the previous versions
but uh here there were a couple of also
small but key changes the first one is
the usage of them either so I'm not sure
if you guys know what tamida is or the
kind of the background with that and
something called tagand which was on on
exit packing
detection capability for especially
created for security vendors so teminder
is a commercial exit Packer it was
always meant to be a commercial product
product protecting
other commercial products so basically
preventing the the reversing of those
it's one of the the very best and heavy
ones utilizing multiple VMS and I don't
want to get into the details but we were
obtaining the very same sample in a upx
format so it was rather clear that they
were trying to get onto the target
system or they were trying to do the
encryption and likely the original up
example was detected there we don't know
exactly like what vendor were they
utilizing there but if you are looking
at the Timeline the the same the up
example was on the very same day so
within just like one day they were
repacking that with time either and they
were deploying that to the Target we
still have the victim information
because they are still utilizing a C2
this time it's also rebranded as
Colossus
two small additional things that they
were changing the execution key for
whatever reason it's not like that you
could be guessing that the tank
character long one but they were
changing it to 32 so that's not even
kind of harder guess it's still being
encrypted encryptedly stored in the
binary so if you know how to kind of
reach that point and how to get it you
can still kind of waste a couple of
hours and just find it they are still
using the the go to work library and
they are having the same kind of panel
key in the base64 format like before the
protonmail is the same the only other
change is that this time they were kind
of thinking that one layer of AES is not
going to be enough or suitable so let's
go for two and let's start to decrypt
and just add one more layer on the
string and kind of just do that in in a
loop so it's increasing the size of the
library because of the kind of the go
hex blobs but not really making the life
of reversers a lot more complicated if
you know what you are looking for
and then we we were notifying a kind of
a bigger jump
actually there is something we were not
including on the timeline because we
were also obtaining at least one
decryption tool from them so that's also
justifying that people were paying at
least there was the intention from this
from the Epsilon gang that they are
providing a decryption to if they pay
the decryption tool was also written in
golang
it was only containing the the private
RSA key for that specific Target and it
would just kind of do a very damp
decryption if you are providing an
argument and it can find the right file
extension then it would just try to
decrypt and basically that's it we
couldn't find the matching ransomware
payload for that one so or an example
what we were bumping into is coming from
this year in January there were a couple
of key changes Colossus was basically
the last one when they were officially
having any kind of branding and starting
this year they were changing from the
goody work so they were using a volk for
the directory traversal they were
changing from protonmail to a new mail
it's not like that you can do a lot with
either of these and they were changing
the encryption now at least five times
on AES so just having the huge hex
blocks into executable
and basically the more important parts
are that panel key and the victim
information is gone with the panel key
so you cannot identify the victim by
just having the sample and then there
are some node was changing at this point
and the template from the old template
to the new one and also the name from
how to recover to how to fix files so
this was the first time they wanted to
go like completely anonymous
then we also had a little bit of a
bigger jump to to dismay and that Trend
was continuing so there were no other
significant changes Daniel mail is the
same the format is the same no more
panel information or victim information
anymore but probably they were just
realizing one mistake they had before
all the previous samples and campaigns
they were encrypting all those things I
was showing in a couple of previous
slides but they were forgetting to do
one interesting and wonky encryption and
that was the file name of the ransom
node so if you could do a search on like
how to recover or how to fix you could
still find some samples and you can
still have some ioc for that one here
they realized that that was a mistake
and from now on they are also encrypting
their Ensemble file name and basically
don't have any meaningful strings
anymore in the binary I mean in a
clearly visible way
then just a couple of the small jumps
and we are already in this year in
August also no significant changes but
then they decide that AES they are five
times is not enough so we want to have
like six times because 66 is the magic
number also you might notice I'm not
sure if there is any kind of correlation
between that but the number of Acts in
the how to recover is also changing from
five to six so that's kind of parallel
maybe it's kind of just they are playing
the game it's not really a meaningful
thing but they are going on with the
annual mail addresses and for one they
were switching back to how to recover
files from how to fix files but other
than that no changes and the last sample
we could observe was from the end of
August just like kind of from a month
ago everything is the same but they are
also back to how to fix files and
nothing else was changing at this point
anymore and we are still hunting and
looking for new samples here
so let's talk about a little bit about
detection and prevention
on the detection side and the prevention
side you can do kind of two things you
can deal with the power show the
executable for the power shell the
DraStic way is of course disabling
Powershell completely if you can do that
in your organization then please go
ahead unfortunately a lot of people can
do that then you can look for this
unusual way of Powershell script is
creating new and multiple PowerShot
scripts in our case it was at least like
10 new files or you can also look at
Powershell script is actually containing
a big base64 encoded blob over like a
500 kilobytes so that's pretty much
unusual why would you do that in any of
your power version scripts on the
executable side things are a little bit
more complicated if you want to do some
drastic changes then you can block Alexa
Packers including tamida and upx because
of themida wouldn't be a big problem
because that's not being used that
widely as upx and you can have some kind
of exclusions the problem is that upx is
still being invited used on a lot of
executables like organizations want to
do just kind of a block like that but
the key Point here is that from an
execution and a behavior point of view
this is just a ransomware payload so
heuristic and behavior-based detections
can still detect that and we were just
providing one example from our product
that we were detecting the file
activities and we were reverting back
the fine modifications from Cache
if you want to do a little bit more and
you are working on the verifier side
then you can look for a couple of
additional things like looking for the
execution policy change in Powershell or
detecting that the they are deleting the
shadow copies or deleting catalogs and
backups or even kind of creating up the
event log the we will be providing also
the decoded Powershell script so you can
look like what
comments they are utilizing for that but
basically these are all the kind of
creative takeaways that they are
preparing the PC for the encryption
and as to go for some hunting then you
can also look for the provided trades
that you have a couple of email
addresses you can kind of do your kind
of a spine Curry Suite the file
extensions and also the different Ransom
note variants it's a it's not up not too
much but basically a kind of a good
starting point with that
and with that we are reaching the or
conclusions here uh so we were dividing
that into two parts first talking about
mainly the the round somewheres and this
specific gang so as stated that the
colony I pipeline incident was a sort of
Turning Point after that there was uh
comparably a much bigger focus on
ransomware gangs and the three letter
agencies were trying a lot harder
to find individuals and criminals
involving with these activities
sometimes they could only find the
Affiliates who are kind of running the
campaigns and executing these but not
the developers but still that's a good
starting point and and things are kind
of pointing into the right direction
so because of that there are some
ransomware groups who were preferring
the gain over the fame so it's why it's
nice to have to have your Wall of Shame
and with a lot of victims and claiming
that you are the best ransomware gang in
town and you were breaching that many
organizations with the extra heat coming
from those three letter regencies maybe
it's not the smartest thing to do
anymore and you can still go on and
operate in a different fashion
so from that it's kind of clear that for
some that changing the name is just an
act and it's not actually
resulting in anything else they are just
rebranding their product
so I said staying under the reader is
actually an option you can still run
campaigns for an accident period of time
so if you look at the Timeline we are
talking about a year and a half since
the first recorded attack with Epsilon
red and we can kind of assume that since
those last samples were from the end of
August that they are still going on
maybe they have only fewer targets and
they are kind of taking those and
picking them carefully but they can
still operate or maybe they are just
kind of greedy and money is never enough
and then while it wouldn't be seemed to
be a big thing first but there is
actually Evolution with ransomware
groups and Returns on their payloads
even if it's not looking that seems to
be significant at first
so they do all these small changes to
kind of try to get under the radar and
try to disappear but also it's very
clear that they are also browsing
borrowing ideas from each other the use
of that kind of seed or key or password
is absolutely not new other families
were using it before and also there are
kind of a couple of things like black
bite who were using an external file in
a C2 and using that as part of the
changing key generation so it goes back
and forth between the teams but also we
could observe other
families which were utilizing that kind
of key scheme in a much better way so
here if you are trained reverser you can
and you have enough time you can debug
it and you can actually find the key
because actually once it's decrypted it
will be just a string there are better
ways to make it happen that if you don't
have the original payload with the
Powershell or the full chain that you
won't be able to execute the the final
payload at all but we don't really want
to give them ideas how to do that
and for the global conclusions that
golang is gaining even more popularity
among cyber criminals so we could see
that not only we Transformer samples and
Transformer families but with malware in
general
the tooling was improving over the years
but we would say that it's still being
far from ideal for example in Ida you
still have to do a lot of manual work
because sometimes because of the either
the seagull or the go detection some of
the code sections are about part of the
code section won't be recognized as code
so if you kind of try to resolve that
this alarm tab first then you might end
up not having all the code result if you
do that later then you have to start a
game so there is a lot of manual work
still needed if you want to have like
the same quality of an idb file than you
had before V3 VC or C plus plus
unfortunately companies are still paying
the ransom that's more not because of
the encryption and the backup so we know
that it's more about the the data itself
excitation part because they are having
that fear that the data is going to be
leaked to the internet what they don't
know is whether the the criminals are
actually going to sell their data in a
silent way so there is absolutely no
guarantee and as long as they are paying
they are still keeping the ransomware
ecosystem very much alive
and for the last
basically it's all saying if something
looks like a ransomware and acts like
around somewhere then we can have a safe
assumption that it's run somewhere the
key thing here is that you shall be
having a security solution which is
having those two specific features with
self-protection and 2fa self-protection
that running a couple of Powershell
scripts with killing processes won't be
able to stop your security solution and
2fa for the reason that if you have like
a cloud-based ones no one can log in
into it like the admin console and just
uninstall the product because then it
will be just as good as without having
any protection on your PC
and with that that's all for today
do you have any questions
all right then thank you everyone thank
you guys
[Applause]
thank you Robert thank you Albert for
that captivating presentation
um we'll be starting up again in two or
three minutes with our next