So far, our series on the current state of ransomware has taken an in-depth look at three ransomware families: CryptoWall, TorrentLocker and CTB-Locker. Today we’ll talk about the variant known as TeslaCrypt.
TeslaCrypt (a.k.a. EccKrypt) is one of the most recent ransomware variants we’ve seen widely that encrypts certain user files and demands a ransom be paid to decrypt the files. Similar to other variants, it uses an AES symmetric algorithm to encrypt files.
TeslaCrypt is distributed widely via the Angler exploit kit and a few other known exploit kits. Using Angler, it exploits Adobe Flash (CVE-2015-0311) and, once successfully exploited, it downloads TeslaCrypt as a payload.
Angler is exploited via an injected iframe from the compromised website. It redirects to a landing page that is highly obfuscated, contains anti-vm techniques, and performs checks for the presence of antivirus software or malware analysis tools like fiddler, etc.
For each obfuscation code, it contains de-obfuscation script in the same web page.
Figure 1 shows the snippet of the obfuscated script in the landing page.
And Figure 2 is the de-obfuscated script that checks for the presence of various antivirus software.
Once all the conditions are met, the decrypted URLs download the Flash exploit which, in turn, downloads the ransomware payload in the temp folder.
It also uses Xtea algorithm to decode the encoded payload. Apart from the Flash exploit, we have also seen exploits related to Silverlight and Internet Explorer.
Angler doesn’t use the file-less payload technique – rather it writes the payload ransomware into the disk.
The TeslaCrypt binary that we have seen so far is usually compiled using Visual C++. The ransomware code is then encoded/compressed within the binary itself.
After decrypting its code in memory, TeslaCrypt overwrites the decrypted MZ binary onto itself.
The decrypted memory MZ binary is also compiled using Visual C++.
It runs multiple threads for different purposes.
- File encryption thread.
- Monitors the following process names and terminates them.
- Contacts the command and control server and sends a few specific details such as the sha-256 value of the key generated from key.dat, Bitcoin address, number of files encrypted, user IP address, etc., as base64 encoded parameter.
- Deletes all backup volume shadow files using vssadmin.exe.
TeslaCrypt creates key.dat under %appdata% where it also drops a copy of itself and creates log.html to store the list of files encrypted. It encrypts user-specific files by enumerating all directories including network drives.
Figure 3 shows the lists of file extensions that will be encrypted, including some related to dozens of games, including saved games, configurations, maps and replays.
It uses AES cipher for encrypting files and stores sha-256 values of the different keys in key.dat along with a Bitcoin payment key. The key.dat structure varies between different variants that we have seen.
It also stores other key information which is not known at the moment.
Also, irrespective of a successful connection to the command and control server, the dropper file still encrypts files. After successful encryption, it shows the GUI window giving details about the payment option.
It also uses some OpenSSL libraries, probably for generating Bitcoin addresses.
After encrypting files, it renames them. Below are some of the extension names it uses for the variants we have seen so far:
After encrypting a specific list of files, it connects to the command and control server via the TOR network using different TOR proxy servers along with specific details as base-64 encoded parameter.
Encoded URI pattern:
Decoded URI pattern:
It then fetches the user’s IP address by contacting “ipinfo.io”.
After encrypting the list of files, it launches a GUI window to show the user that their files have been encrypted and offers them a payment option to get the decryption key as shown in Figure 4.
It also gives the option to decrypt a single file for free, as shown in Figure 5, in order to convince the user that they will get back all their files once they pay.
TeslaCrypt gives the option to use Bitcoin, PaySafeCard or Ukash for payment. We haven’t yet seen evidence that it can target any non-English users by using other languages in their ransom GUI window.
Among all the variants analyzed in this paper, next to CryptoWall, TeslaCrypt has the most number of infections seen widely across all countries.
Sophos protects its customers from TeslaCrypt using the following detections: HPmal/EccKrpt-A, Troj/TeslaCrypt-*, Mal/ TeslaCrypt-*, Troj/Ransom-*.
Having Sophos HIPS technology enabled is strongly recommended to block ransomware proactively.
If you suspect you’ve been compromised by ransomware, you can remove the malware using our Free Virus Removal Tool. Sadly, there’s not much you can do to get your files back except to pay the ransom – the encryption is too strong to crack.
Apart from having your antivirus up to date, there are additional system changes to help prevent or disarm ransomware infections that a user can apply.
1. Back up your files.
The best way to ensure you do not lose your files to ransomware is to back them up regularly. Storing your backup separately is also key – as discussed, some ransomware variants delete Windows shadow copies of files as a further tactic to prevent your recovery, so you need to store your backup offline.
2. Apply windows and other software updates regularly.
Keep your system and applications up to date. This gives you the best chance to avoid your system being exploited using drive-by download attacks and software (particularly Adobe Flash, Microsoft Silverlight, Web Browser, etc.) vulnerabilities which are known for installing ransomware.
3. Avoid clicking untrusted email links or opening unsolicited email attachments.
Most ransomware arrives via spam email either by clicking the links or as attachments. Having a good email anti-virus scanner would also proactively block compromised or malicious website links or binary attachments that lead to ransomware.
4. Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
We’ve seen many malicious documents that contain macros which can further download ransomware silently in the background.
5. Install a firewall, block Tor and I2P, and restrict to specific ports.
Preventing the malware from reaching its call-home server via the network can disarm an active ransomware variant. As such, blocking connections to I2P or Tor servers via a firewall is an effective measure.
6. Disable remote desktop connections.
Disable remote desktop connections if they are not required in your environment, so that malicious authors cannot access your machine remotely.
7. Block binaries running from %APPDATA% and %TEMP% paths.
Most of the ransomware files are dropped and executed from these locations, so blocking execution would prevent the ransomware from running.