Forest Global Training Partners

Cyber Risks · Cisco Talos

Cryptowall 3.0: Back to the Basics

Summary: Cisco Talos analyzed a Cryptowall 3.0 sample delivered in a zip file with multiple dropper files that differ only in the encryption algorithm used to obfuscate the dropper and build the binary. The dropper registers the victim with a command-and-control server through an I2P proxy, sending a request string in the format {<Request ID>|crypt1|<Victim PC MD5>|<OS Ver Index>..||External Ip Address}, and the analyzed sample removed dropper features that were operational in version 2.0.

Why it matters: The dropper checks whether its parent process is perl.exe or python.exe and, if so, runs an endless loop instead of the Cryptowall code - a deliberate evasion aimed at automated analysis environments. Talos also notes that many companies believed they had a solid backup plan only to find the malware encrypted the backup, which is the stake to sit with before the next restore test.

Read the original at Cisco Talos ↗

Topics
Malware
Related