Softpanorama Bulletin
Vol 25, No.10 (October, 2013)

Connection wіth thе C&C server іs established through еіthеr а hardcoded IP (184.164.136.134, whiсh iѕ dоwn now) оr іf thаt fails through а domain generation algorithm located аt 0x40FDD0 аnd seeded bу GetSystemTime. At thіs time xeogrhxquuubt.com аnd qaaepodedahnslq.org arе bоth active and point tо 173.246.105.23.

Thе communication channel usеѕ POST tо thе /home/ directory оf thе C&C server. Thе data іѕ encrypted uѕіng RSA. Thе public key сan bе fоund аt offset 0x00010da0 inѕide thе malware file.

On first contact thе malware wіll send іn аn information string containing thе malware version, thе system language, aѕ well аs аn іd аnd а group id. In return іt receives а RSA public key.

Once a suitable command and control server has been found, the malware will start to communicate through regular HTTP POST requests.

HTTP just goes about as a wrapper. However, all genuine information traded throughout the correspondence between the bot and its command and control server is encoded utilizing RSA. The public key utilized for the encryption of the communication is consequently inserted inside the malware index. Utilizing RSA based encryption for the communication not just permits the attacker to encrypt the actual connection between the malware and its server, additionally it verifies the malware is conversing with the attacker's server and not a virtual lab controlled by malware analysts.

Once the framework has been solidly tainted and a communication channel to the command and control server has been made, the malware will begin the encryption process by soliciting an encryption key. A normal request incorporates the version of the malware, a numeric ID, the system name, a group id and additionally the language of the system.

The key is saved inside the HKCU\Software\CryptoLocker. If you want to capture the key on your system, the easiest way to do so is to break on Crypt String to Binary A.

• The malware targets files using the following search masks:

*.odt, *.ods, *.odp, *.odm, *.odc, *.odb, *.doc, *.docx, *.docm, *.wps, *.xls, *.xlsx, *.xlsm, *.xlsb, *.xlk, *.ppt, *.pptx, *.pptm, *.mdb, *.accdb, *.pst, *.dwg, *.dxf, *.dxg, *.wpd, *.rtf, *.wb2, *.mdf, *.dbf, *.psd, *.pdd, *.eps, *.ai, *.indd, *.cdr, ????????.jpg, ????????.jpe, img_*.jpg, *.dng, *.3fr, *.arw, *.srf, *.sr2, *.bay, *.crw, *.cr2, *.dcr, *.kdc, *.erf, *.mef, *.mrw, *.nef, *.nrw, *.orf, *.raf, *.raw, *.rwl, *.rw2, *.r3d, *.ptx, *.pef, *.srw, *.x3f, *.der, *.cer, *.crt, *.pem, *.pfx, *.p12, *.p7b, *.p7c

The encryption used to encode records matching these mask is a mix of RSA and AES. Fundamentally the malware will prepare another AES 256 key for every document it is set to encode. The key is then used to encode the file. The AES key itself is then encrypted utilizing the public RSA key acquired from the server. The RSA encrypted blob is then saved together with the encoded file content inside the encoded document. As a result encrypted records are somewhat bigger than their originals. Also the malware records the file it is encrypted inside the HKCU\Software\CryptoLocker\Files key. Vаlue names аrе thе file paths wherе "\" haѕ bееn replaced wіth "?". Sadly, as soon as the encryption of the data is done, reversing it is not possible. To get the file exact AES key to decrypt a file, you need the private RSA key matching to the RSA public key generated for the victim's system by the command and control server. Though, this key never leaves the command and control server, putting it out of span of everybody with the exception of the attacker.