Fake Ransomware decryption tools: The rabbit hole

 

Backstory

During the past month or so, following the announcement of our Akira ransomware decryption service, we have been responding to Akira incidents around the world. Recently, a victim organisation contacted us for help, but their story was quite unusual compared to the other victims we have been assisting.

As it turned out, they had indeed been hit by the Akira ransomware but in addition to this, they shared a decryption tool with us and told us that they had contacted some "Decryption Experts" and paid for this tool upfront. As their Akira incident was recent and the decryption tool that they shared with us was not made by Avast, we immediately knew that something suspicious was going on. 

As a recap: Legitimate decryption tools released to the public can help with older variants of Akira, that had a much more simple encryption scheme. The current variant of Akira uses up to 8 encryption keys per file, as well as two different encryption schemes, which makes it unfeasible to release a standalone decryption tool. This is why we offer the decryption as a paid service (paid after successful decryption), since it takes considerable amounts of computing power and manual binary analysis performed by our experts.

We decided to take a closer look at the tool they shared to see what they had paid for. What we uncovered was a widespread campaign of new fake ransomware decryptors, being actively advertised via Youtube channels, tailor made websites and reddit.

This post may get a bit technical at some points.

Fake decryptor analysis

The fake akira decryptor tool (SHA1: c66c5f0e7876a53c1af4da241d6248c05ff9dc4b) comes to us from the future in the form of a .NET executable with a modified compiler timestamp of "22/11/2080 7.08.52".

Fake Akira decryptor user interface

Supposedly, all the victim has to do is to input their unique Login ID/Chat ID that is found in the Akira ransomware note. Behind the scenes, the Login ID is checked to see if matches a hardcoded value. Our hypothesis is that this hardcoded value is the actual victim Login ID that the victim has passed on to the actors behind this campaign. The actors then compile a new executable for each victim, with their ID hardcoded into the program.

DnSpy analysis

By loading the executable into dnSpy, an open source .NET debugger and assembly editor, we can take a look at what the code is doing. To save us some effort, the actors have chosen not to obfuscate their code and static analysis is a breeze. Immediately after loading the binary into dnSpy, looking at the embedded resources, we spotted an additional logo image referring to a "universal decryptor". We will circle back on this discovery after analyzing the "Decryption" part of the code.

Akira Decryption.exe resources

Looking inside the EncryptDecryptFiles class, we find the Decrypt() function. The function starts by comparing the user submitted login ID to a hardcoded value as previously mentioned. If the value matches, the function goes through each file present defined in the current path (C:\\) and looks for files that contain the string "akiraa" in their name. 

We are not sure if this typo is intentional or if it is simply an error on the actors part, because on a machine with an Akira infection, the encrypted files have an ".akira" suffix. Because of this, the check fails on every file and an error message is shown to the victim: "Your personal ID is expired by Hackers. Please update!" Of note: By design (logic error or intentional), even if the program would find ".akiraa" files and overwrite them, it would still display the same error message to the victim.

Decrypt function

Interestingly, the executable also contains an Encrypt function, which is never called in the binaries that we found. Our hypothesis is that this function is called in the variants that the actors use to first encrypt files in order to show that the decryption is working in their demo videos. This is further supported by the presence and usage of actual cryptography functions via the System.Security.Cryptography .NET API.

Cryptography API usage

Pivoting on resources

To circle back on the universal decryptor image that was present in the resources, we found two interesting artifacts to further pivot on and look for related binaries. The first artifact was the Akira decryption image displayed in the tool, named "tumblr_252fa...". Searching for this string in Virustotal showed 3 similar binaries. One supposedly for lockbit decryption, one for djvu and one for phobos ransomware.

Virustotal search for the resource name

These 3 binaries are also .NET executables and a quick analysis reveals that they are identical in function to the Akira decryption binary. Below is a comparison of the Akira decryption binary and one of the newly found binaries. The Decrypt function (and other functions) are identical, except for the hardcoded Chat ID that the victim provides to the actors.

Comparing the two binaries in dnSpy

The second artifact is the presence of the "universal decryptor" image in the resources. Searching for universal decryptor in google, we came across a website "universaldecryptor.net". This website promises guaranteed recovery of files for stop/djvu ransomware victims in exchange for an undisclosed amount of Tether (USDT) or Bitcoin cryptocurrency. 

The page is filled with seemingly fake reviews and testimonials along with a FAQ section to reassure victims of the legitimacy of the operation. Victims are instructed to contact the actors via whatsapp, telegram or email, most likely to carry out the payment of cryptocurrency and receive the fake decryption tool.

universaldecryptor website

The page also contains an embedded Youtube video, allegedly showing the tool working and decrypting files. Searching on Youtube for "ransomware decryption" leads to multiple channels and several hundreds of videos advertising the successful decryption of any number of ransomware variants. ( lockbit, akira, djvu, phobos etc.).

These videos and their descriptions containing links lead us to the akiradecryption[.]org website. Looking awfully familiar. Any doubt that these websites and programs are not connected, should be gone by this point. The client that reached out to us originally also confirmed that this is indeed where they received the akira decryption executable from.

akiradecryption website

Looking at the list of Youtube channels we found during analysis reveals that on some channels, the campaigns have been active for at least 2 years. All channels follow a similar pattern of releasing "proof of concept" videos for whatever ransomware strain, with the video showing how the tool supposedly decrypts files.

one channel with multiple videos for different ransomware

Conclusion

The uncovered campaign is yet another example of criminals trying to exploit desperate victims for financial gain. It should go without saying, but in the event of a ransomware attack your first point of contact should be your local law enforcement agency, followed by actual incident response experts and legitimate security vendors. (not a website that requests USDT, Bitcoin or any other cryptocurrency as payment for their services).

In addition to this, the importance of backups (and actually verifying that you can restore from said backups) can not be overstated. 

We have notified the relevant parties to get these channels, websites and user accounts taken down.

If you got this far, thank you for reading the post and stay safe. If you have any questions or need assistance with Akira recovery or anything else, don't hesitate to reach out to us at support@fitsec.com.

Eerik Reis, Toni Koivunen & The Fitsec APT research team

Indicators of Compromise

Websites:

hxxps://akiradecryptor[.]org

hxxps://universaldecryptor[.]net

hxxps://lockbitdecryptor[.]com

hxxps://phobosdecryptor[.]ru

hxxps://bytees[.]org

hxxps://stopdjvudecryptor[.]org

Youtube channels:

@StopRansomware

@stopdjvuransomware

@stopdjvudecryptortool

@stopdjvudecryption3546

@stopdjvuransomwaredecryptor

@DecryptorMaestros

@stopdjvudecryptorofficial

@Stopdjvudecryption211

@davidson797

@Howtodecryptguide676

@RansomwareDecryptoruniversal

@AkiraDecryptor

@decryptakiravirus

@Akirafilesdecryption

@HuntersInternationalDecryptor

@Boldbytes-hb8jp

@RansomAttack

@dotertool

@akiraransomwre

@safepcfromransom

@Decryptorransomware

File hashes (fake decryption binaries):

b67788c6dbd20b39d9ca44e8c8ed46a7e4295160

565d14be027095852bee7ecae5c554f0d322e720

ae0c64f2ad1075a76c4b348ed69e61a8864a8897

🚨 Exciting News

We at Fitsec Ltd are now able to successfully decrypt files encrypted by the Akira malware! And can now help victims! Do not hesitate to contact us.

https://www.akirahelp.com/
https://feed.fitsec.com/

hashtag#akira hashtag#akiraransomware hashtag#ransomware hashtag

 

Integrate Threat Intelligence Feeds into Third-Party Security Solutions

Integrating Threat Intelligence Feeds into third-party security solutions is a critical step towards effective threat detection and response. Through this integration, organizations can automate numerous cybersecurity processes, enhancing both the speed of response and the accuracy of detection

API Integrations:

API integrations allow for direct and real-time data exchange between threat intelligence feeds and security solutions. This significantly accelerates threat identification and enables immediate response, minimizing potential damage.

 

SIEM and SOAR Systems:

SIEM systems analyze and prioritize threat data, providing in-depth insights into potential threats. SOAR solutions take this a step further by automating the processes of threat detection, investigation, and response. Together, these systems create a strong foundation for threat management by seamlessly integrating threat intelligence data into security operations.

 

Challenges:

Challenges in integration include ensuring data quality and reliability. By selecting reliable threat intelligence sources and adhering to best practices in data management, organizations can reduce false positive alerts and improve the efficiency of their security solutions.

 

By integrating threat intelligence feeds into third-party security solutions, organizations can significantly improve their ability to detect and respond to threats in real-time. This not only speeds up response times but also makes the work of the cybersecurity team more efficient, allowing them to focus on more critical tasks. When executed correctly, this integration provides organizations with a significant competitive advantage in the realm of cybersecurity.

Use Threat Intelligence Feeds for Automated Firewall and IDS/IPS Rule Updates

Leveraging threat intelligence feeds for automated updates to firewall and Intrusion Detection/Prevention Systems (IDS/IPS) rules is a critical method in combating cybersecurity threats. This process enables organizations to swiftly respond to new and evolving cyber threats. Automatic rule updates are based on real-time threat intelligence provided by threat intelligence feeds, allowing organizations to effectively update their security system rules, reducing the need for manual labour and enhancing network security.

 

Integration Process:

The integration process starts by selecting an appropriate threat intelligence feed and connecting it to the firewall or IDS/IPS system, often using API interfaces or other integration mechanisms. Once the feed is connected, the system analyses incoming threat intelligence and automatically updates its rules accordingly. This may involve creating new rules to identify and block traffic from known malicious IP addresses or updating existing rules to reflect new types of attacks.

 

Automation Requirements:

Such automation requires careful configuration and testing to avoid false positives that could block legitimate traffic. It's also crucial to ensure that rule updates are appropriate and do not cause unintended side effects on system performance.

 

In summary, the use of threat intelligence feeds for automatic rule updates represents an effective strategy for managing cybersecurity threats. This approach allows for quick and targeted responses to new threats, improving an organization's ability to protect its networks and information systems in a constantly changing cybersecurity environment.

Integrate Threat Intelligence Feeds with SIEM

Integrating threat intelligence feeds into Security Information and Event Management (SIEM) systems is a key method for automating the analysis of cybersecurity events. This process enables the rapid utilization of up-to-date threat information, significantly enhancing cyber defense efficiency.

 

Evolution of SIEM Technology:

The evolution of SIEM technology from basic log management systems to advanced defense platforms is significant. The integration of artificial intelligence (AI) has strengthened their analytical capabilities, enabling the detection of complex patterns and potential security incidents that would elude human analysis.

 

Integration and SIEM:

Threat intelligence feeds provide a continuous flow of the latest threat information, such as known attack vectors and techniques. When integrated into SIEM systems, they add value by offering real-time data that aids in quicker identification and response to potential risks.

 

Benefits of Automation:

The automation in SIEM systems, combined with the information from threat intelligence feeds and analysis of logs, free up resources for more critical security tasks, improving overall cybersecurity operations. Rapid detection and response to threats reduce the window of opportunity for attacks, enhancing the ability to protect critical assets.

Utilizing machine learning for event correlation in SIEM reveals hidden threats and enables proactive measures against emerging attack vectors and streamlined compliance monitoring and reporting: Automating compliance monitoring and reporting within SIEM makes audits more efficient and accurate.

 

In conclusion, the integration of threat intelligence feeds into SIEM systems is a critical step in the automation of security event analysis. This combination improves the ability to detect and respond quickly to cyber threats, which is vital in today's constantly changing cybersecurity landscape.

Utilize Threat Intelligence Feeds for Creating and Updating Website Blacklists

The use of threat intelligence feeds in creating and updating blacklists of websites containing known phishing sites is crucial in combating phishing attacks. These feeds provide up-to-date information on known phishing sites, helping organizations to swiftly respond to new threats.

Creating Blacklists with Threat Intelligence Feeds:

Information on phishing sites is gathered from threat intelligence feeds, which include detailed data about malicious URLs and the techniques used in scams. Based on this information, blacklists are created.

Updates and Maintenance:

As phishing sites continuously evolve, regular updates of blacklists are essential. Malicious actors register new domains, make changes to their phishing sites, and refine their methods constantly. The real-time information provided by feeds enables quick updates, keeping the lists current with the latest threats.

Integration into Cybersecurity Systems:

The created blacklists are integrated into an organization’s security controls, such as email filters, firewalls, and web browsers. This integration allows for automatic actions, like alerting or blocking access when users attempt to visit known phishing sites.

In conclusion, leveraging threat intelligence feeds for creating and updating blacklists of websites is a vital component of cybersecurity against phishing attacks. These feeds offer critical, real-time information about known phishing sites, enabling rapid and accurate updates to blacklists. By integrating these updated lists into an organization's cybersecurity systems, effective prevention of access to malicious sites and protection of users from scams are achieved. This makes threat intelligence feeds an invaluable tool in a modern cybersecurity strategy, helping organizations stay a step ahead of the evolving tactics of cybercriminals.

Detect Malware Traffic with Threat Intelligence Feeds

The use of threat intelligence feeds to detect malware traffic, such as communication with Command and Control (C&C) servers, is a critical component of cybersecurity. These feeds provide essential information for combating cyber threats.

Analyzing Suspicious Traffic:

Threat intelligence feeds include data on network addresses used by known malware, such as IP addresses and domain names. By analyzing an organization's network traffic and comparing it with the information in the feeds, it's possible to identify traffic that may indicate malware activity. This includes unusual contacts to known malicious addresses or abnormal data traffic.

Identifying C&C Server Communications:

Communication with C&C servers is characteristic of many types of malware. Threat intelligence feeds help to detect and distinguish these communications from normal traffic. Identifying such traffic allows organizations to take proactive measures, such as blocking the traffic or isolating infected devices.

Countermeasures and Security Actions:

Once suspicious traffic is identified, organizations can implement security measures to combat malware. This may include filtering the traffic, sending alerts to cybersecurity teams, and cleaning infected devices. Continuous updates of threat intelligence feeds ensure that organizations stay informed about the latest threats and countermeasures.

In summary, the use of threat intelligence feeds is essential for detecting and countering malware traffic. These feeds provide valuable information that helps identify and prevent cyber threats, protecting organizations and their assets. Continuous monitoring and updates ensure that cybersecurity measures are effective and up-to-date.

Leverage Threat Intelligence to Update Cybersecurity Rules and Practices

As the world of cybersecurity continually evolves, staying ahead of emerging threats is crucial. This article discusses how threat intelligence can be pivotal in updating cybersecurity rules and practices to counter current threats effectively.

 

Real-Time Information and Response:

Modern threat intelligence feeds provide organizations with up-to-date information about new vulnerabilities and types of attacks. This enables swift response where cybersecurity rules are updated immediately to thwart these new threats. For instance, if a threat intelligence service detects a new malware spreading, organizations can promptly update their security protocols to prevent potential damage.

 

Customization and Focus:

By using threat intelligence, organizations can tailor their security measures to meet their specific needs. Different organizations face varied threats based on their industry, size, and the technologies they use. Threat intelligence allows them to identify and focus on the areas most critical to them.

 

Proactive Approach and Risk Management:

Analyzing threat intelligence for potential future threats allows organizations to develop strategies to counter them before they become problematic. This proactive approach not only saves time and resources in the long run but also enhances an organization's ability to defend against cyber-attacks.

 

In conclusion, the utilization of threat intelligence in updating cybersecurity rules and practices is essential for organizations to protect against current and future cyber threats. It provides the necessary tools for real-time response, customization, and proactive protection, ensuring that an organization's cybersecurity remains up-to-date and effective. Continuous updating of cybersecurity based on threat intelligence is not just a technical requirement but a strategic necessity in the ever-evolving world of cyber threats. It demands constant vigilance, adaptability, and commitment to enhancing cybersecurity, which is key to ensuring an organization's cyber resilience.

Utilize Threat Intelligence Feeds in the real-time detection and identification of potential threats, such as malware or data breaches

Threat intelligence feeds are a critical tool in cybersecurity, providing real-time information about potential threats, such as malware and data breaches. With their help, organizations can quickly identify and respond to new risks. This article focuses on how these feeds can be effectively used in threat detection and identification.

 

Integration and Automation of Threat Intelligence Feeds:

By integrating threat intelligence feeds into their security infrastructure, such as firewalls and intrusion detection systems, organizations can update rules and automatically detect and fend off threats. Moreover, automated analysis tools scan the data from the feeds in real-time, identifying harmful URLs, IP addresses, and file hashes that indicate compromise or attack.

 

Incident Response and Providing Context:

When a potential threat is identified, threat intelligence feeds provide essential context, such as information about the nature of the attack and possible impacts. This information is crucial for incident response teams, who need to understand the scope and methods of the attack for quick and effective response.

 

Challenges and Considerations:

While threat intelligence feeds are extremely useful, they bring challenges, such as managing the large volume of data and ensuring its relevance. This requires sophisticated filtering and prioritization mechanisms. Additionally, the quality of feeds can vary, and it's important to combine automatic analysis with expert interpretation.

 

In summary, threat intelligence feeds are key in the real-time observation and identification of threats, such as malware and data breaches. Their effective utilization requires integration, automation, and expert analysis. When these elements are combined, organizations can respond quickly and effectively to the growing number of cyber threats.

Monitoring and Identification of Malware with Threat Intelligence Feeds

Integrating threat intelligence feeds into your existing cybersecurity systems, they make your existing cybersecurity systems smarter in terms of what is malicious, thereby allowing you to gain greater benefits from your systems. Threat intelligence feeds are essential tools in monitoring and identifying the development of malware.

Monitoring Malware Development:

Threat intelligence feeds continuously track the evolution of malware. They collect information from various sources, such as malware analyses and cybercrime forums, providing updated information on new malware versions and mutations. This enables quick response to new threats and helps maintain your security posture.

Identifying Types of Malware:

Feeds utilize advanced analysis methods, such as machine learning and behavioral analysis, to identify types of malware. They can distinguish between different types of malware, such as trojans, ransomware, and worms, based on their behavior. This helps organizations to quickly identify and respond to various types of cyber threats.

Identifying Methods of Distribution:

Understanding how different malware spreads allows organizations to develop more effective protection measures. Feeds provide information about malware distribution channels, such as via email, websites, or social media. This information is crucial for understanding the unique characteristics of these channels and targeting protective measures accordingly.

In summary, threat intelligence feeds are essential tools for tracking the development of malware, categorizing it, and understanding its distribution methods. They offer valuable information that helps organizations stay one step ahead of cyber threats.