Sensor Tech
Open-Source Ransomware Based on Hidden Tear and EDA2 on the Loose
http://sensorstechforum.com/open-source-ransomware-based-hidden-tear-eda2-loose/
August 25, 2016 by Milena Dimitrova+
Open-source ransomware is a real issue which is continuously evolving. Over the past few weeks, researchers have caught three open-source crypto virus strains, based on Hidden Tear and EDA2. What all of the three strains have in common is that they all look for files related to web servers and databases. This could easily mean that the ransomware viruses are specifically
Three Ransomware Strains Based on Open-Source Code Detected in the Wild Interestingly, Hidden Tear and EDA2 are widely accepted as the first open-source ransomware coded for educational purposes. This idea quickly turned out to be fishy, as it didn’t take long for cyber criminals to exploit the code for malicious operations. As pointed out by TrendMicro researchers: RANSOM_CRYPTEAR.B is one of the many Hidden Tear spinoffs that infect systems when users access a hacked website from Paraguay. Magic ransomware http://sensorstechforum.com/magic-the-open-source-ransomware-that-emerged-from-github/ (detected as RANSOM_MEMEKAP.A), based on EDA2, came soon after CRYPTEAR.B’s discovery. It’s not hard to guess why open-source ransomware is becoming so popular among crooks – it offers the ease and convenience of not having to be tech-savvy. What is more, before the source codes of Hidden Tear and EDA2 were taken down, they were publicly available long enough for cyber criminals to modify the code according to their needs. Not only are cyber criminals using open-source code but they are also using elements from pop culture. For example, RANSOM_KAOTEAR.A is built on the Hidden Tear code, uses the filename kaoTalk.exe and includes KakaoTalk icon. KakaoTalk is a popular messaging app in South Korea with 49.1 million active users globally. Another example here is the POGOTEAR or PokemonGo ransomware. The ransomware was found in the wild by the malware researcher Michael Gillespie. It is thought that the virus might still be in development or could be tweaked more in the near future, but it looks nasty enough from now. The PokemonGO ransomware places the .locked file extension on each of the encrypted files. After that process is complete, the file هام جدا.txt is placed on the desktop, containing the ransom instructions. The name of the file is translated as “very important”. Read More about PokemonGo Ransomware Let’s not forget FSociety ransomware (RANSOM_CRYPTEAR.SMILA) which is an EDA2-based ransomware and is “inspired” by the hacker group in the Mr.Robot. http://sensorstechforum.com/mr-robot-season-2-hacks-exploits-fsociety-cryptowall/ Fsociety ransomware is based on the EDA2 ransomware project which is an open source ransomware code uploaded online and created by Utku Sen. Since then, many variants of the EDA2 project have popped up, because all it takes is someone who knows coding to take this source code and design own version of ransomware, just like Fsociety ransomware variant is.
What Else Do KaoTear, POGOTEAR, and Fsociety Ransomware Share? TrendMicro researchers point out that these three ransomware cases have other striking similarities. They target almost the same file types to encrypt: *.txt, *.doc, *.docx, *.xls, *.xlsx, *.ppt, *.pptx, *.odt, *.jpg, *.png, *.csv, *.sql, *.mdb, *.hwp, *.pdf, *.php, *.asp, *.aspx, *.html, *.xml, and *.psd. As mentioned in the beginning, some of these file extensions (such as XML, PHP, and ASPX) are related to web servers which points to attacks targeting businesses. Moreover, all three ransomware search for SQL and MDB files, associated with databases. […] POGOTEAR and FSociety may still be under development. One indicator for this is POGOTEAR’s use of a private IP for its command-and-control (C&C) server. Since it uses a private IP, the information sent stays within the organization’s network. On the other hand, FSociety searches for a folder named ‘test’ in the %Desktop%. If the said folder is not found, FSociety does not encrypt any files.
The Dangers of Open-Source, Educational Malware Open-source ransomware has raised a red flag in the cyber security community. Hidden Tear and EDA2 were both exploited by cyber crooks who used the public source code, modified it and attacked users. Another educational ransomware spotted is ShinoLocker (detected as RANSOM_SHINOLOCK.A). Aside from file encryption, it can also uninstall itself and restore files it has encrypted. The developer created it for simulation purposes. The moral here is that cyber security researchers have to address the possible risks and consequences of developing educational malware. Leaving the source-code in the public space available to anyone has proven to be a bad idea. Instead, researchers should distribute these only to credible recipients through secure channels. Before releasing anything to the public, researchers need to assess its benefits against the potential threats that it can introduce if it goes into the wrong hands, TrendMicro concludes.