The eCh0raix Ransomware

<h2>Introduction</h2><p>Anomali researchers have observed a new ransomware family, dubbed eCh0raix, targeting QNAP Network Attached Storage (NAS) devices. QNAP devices are created by the Taiwanese company QNAP Systems, Inc., and contain device storage and media player functionality, amongst others. The devices appear to be compromised by brute forcing weak credentials and exploiting known vulnerabilities in targeted attacks. The malicious payload encrypts the targeted file extensions on the NAS using AES encryption and appends .encrypt extension to the encrypted files. The ransom note created by the ransomware has the form shown below.</p><pre> All your data has been locked(crypted). How to unclock(decrypt) instruction located in this TOR website: http://sg3dwqfpnr4sl5hh.onion/order/[Bitcoin address] Use TOR browser for access .onion websites. https://duckduckgo.com/html?q=tor+browser+how+to Do NOT remove this file and NOT remove last line in this file! [base64 encoded encrypted data]</pre><p>Note that there is a typo in the ransom note which may indicate that the actors behind this campaign are not native-English speakers.</p><h2>QNAP Technical Breakdown</h2><p>The malware is written and compiled in the Go programming language. The ransomware is very simple with its source code being fewer than 400 lines. A reconstruction of the source code tree is shown below. The functionality is standard for a ransomware: check if already encrypted, walk the file system for files to encrypt, encrypt the files, and produce the ransom note.</p><pre> Package main: /home/user/go/src/qnap_crypt_worker File: main.go getInfo Lines: 61 to 123 (62) checkReadmeExists Lines: 123 to 132 (9) (init)0 Lines: 132 to 161 (29) main Lines: 161 to 213 (52) (main)func1 Lines: 185 to 191 (6) randSeq Lines: 213 to 222 (9) in Lines: 222 to 231 (9) writemessage Lines: 231 to 238 (7) chDir Lines: 238 to 269 (31) encrypt Lines: 269 to 349 (80) makesecret Lines: 349 to 358 (9) </pre><p>Upon execution, the malware reaches out to the URL http://192.99.206[.]61/d.php?s=started and notifies the Command and Control (C2) that the encryption process has begun, as shown in Figure 1.</p><p style="text-align: center;"><em><img alt="Checks if the instance is already running by reaching out to a C2 IP. If it is, exit process." src="https://cdn.filestackcontent.com/X3EBFdWkRDermvDvhtlX"/><br/> Figure 1 - Checks if the instance is already running by reaching out to a C2 IP. If it is, exit process.</em></p><h2>Establishing C2 connection</h2><p>The malware communicates to the C2 sg3dwqfpnr4sl5hh[.]onion via a SOCKS5 Tor proxy at 192.99.206[.]61:65000, as seen in Figures 2 and 3. Based on the analysis it is clear that the proxy has been set up by the malware author to provide Tor network access to the malware without including Tor functionality in the malware.</p><p style="text-align: center;"><em><img alt="Port scan results on Proxy IP." src="https://cdn.filestackcontent.com/1udID598S0W59WFxoLOd"/><br/> Figure 2 - Port scan results on Proxy IP.</em></p><p style="text-align: center;"><em><img alt="Connects via SOCKS5 proxy" src="https://cdn.filestackcontent.com/hizXWbv3QxiNghf9PndD"/><br/> Figure 3 - Connects via SOCKS5 proxy</em></p><p>The malware retrieves the RSA public key and the ‘readme’ text content from the C2 server. One of the samples analyzed used the URL “http://sg3dwqfpnr4sl5hh[.]onion/api/GetAvailKeysByCampId/10”, that possibly suggests this was the 10th campaign run by the threat actor. The data returned by the C2 server is encoded in JSON and the malware unserializes the data into the following Go data struct:</p><pre> type main.Info struct { RsaPublicKey string Readme string }</pre><h2>Encryption Module</h2><p>The module generates a 32 character random string from the array “abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()_+” to create an AES-256 key. By using this fixed set of characters, the effective key space is 192-bit. As can be seen in Figure 4, the malware initializes the math random page with the seed of the current time. Since it is using the math’s package to generate the secret key, it is not cryptographically random and it is likely possible to write a decryptor.</p><p style="text-align: center;"><em><img alt="Set the math random seed with the current time." src="https://cdn.filestackcontent.com/qhi0H1GKS2yCsnD4M0yy"/><br/> Figure 4 - Set the math random seed with the current time.</em></p><p>The generated AES key is then encrypted with a public key which was either embedded in the malware sample or retrieved from the C2 server, depending on the version of the malware. The resulted string is then encoded with base64 and added to the README_FOR_DECRYPT.txt file.</p><p>Before the malware encrypts any files, it proceeds to kill the below list of processes. The processes are stopped on the infected NAS by issuing the commands “service stop %s” or “systemctl stop %s”.</p><ul><li>apache2</li><li>httpd</li><li>nginx</li><li>mysqld</li><li>mysql</li><li>php-fpm</li><li>php5-fpm</li><li>postgresql</li></ul><h2>File Encryption</h2><p>The files are encrypted with AES in Cipher Feedback Mode (CFB) with the secret key that was generated. When selecting files to encrypt, the ransomware skips any files where the absolute path for the file contain any of the strings listed below.</p><ul><li>/proc</li><li>/boot/</li><li>/sys/</li><li>/run/</li><li>/dev/</li><li>/etc/</li><li>/home/httpd</li><li>/mnt/ext/opt</li><li>.system/thumbnail</li><li>.system/opt</li><li>.config</li><li>.qpkg</li></ul><p>If the path does not contain any of the strings, it checks the file extension for the file. If the file extension is one of the extensions shown below, the ransomware encrypts the file. The encrypted data is written to a new file with the original name and file extension but the file extensions “.encrypt” is appended to the end. Once the file has been written, the original file is removed.</p><pre> .dat.db0.dba.dbf.dbm.dbx.dcr.der.dll.dml.dmp.dng.doc.dot.dwg.dwk.dwt.dxf.dxg.ece.eml.epk.eps.erf.esm.ewp.far.fdb.fit.flv.fmp.fos.fpk.fsh.fwp.gdb.gho.gif.gne.gpg.gsp.gxk.hdm.hkx.htc.htm.htx.hxs.idc.idx.ifx.iqy.iso.itl.itm.iwd.iwi.jcz.jpe.jpg.jsp.jss.jst.jvs.jws.kdb.kdc.key.kit.ksd.lbc.lbf.lrf.ltx.lvl.lzh.m3u.m4a.map.max.mdb.mdf.mef.mht.mjs.mlx.mov.moz.mp3.mpd.mpp.mvc.mvr.myo.nba.nbf.ncf.ngc.nod.nrw.nsf.ntl.nv2.nxg.nzb.oam.odb.odc.odm.odp.ods.odt.ofx.olp.orf.oth.p12.p7b.p7c.pac.pak.pdb.pdd.pdf.pef.pem.pfx.pgp.php.png.pot.ppj.pps.ppt.prf.pro.psd.psk.psp.pst.psw.ptw.ptx.pub.qba.qbb.qbo.qbw.qbx.qdf.qfx</pre><p>Once the entire encryption process is completed the malware reaches out to the URL http://192.99.206.61/d[.]php?s=done and sends the command “done” to notify the completion of encryption, Figure 5.</p><p style="text-align: center;"><em><img alt="Send “done” to C2" src="https://cdn.filestackcontent.com/XCthPlGARhO3Av7zD81X"/><br/> Figure 5 - Send “done” to C2</em></p><h2>C2 Analysis</h2><p>The analyzed C2 URL (http://sg3dwqfpnr4sl5hh[.]onion) has partial directory listing enabled, and after browsing through the directories, Anomali researchers were able to find a sample named “linux_crypter”. The sample was packed by UPX. Analysis of the unpacked sample confirmed that it is written in Go and had some modifications to the previously analysed sample. The sample found on C2, checks the locale of the infected NAS for Belarus, Ukraine, or Russia and exits without doing anything if a match is found. This technique is common amongst threat actors, particularly when they do not wish to infect users in their home country.</p><h2>Analysis</h2><p>The eCh0raix ransomware, named after a string found in the malware, is a ransomware used in targeted attacks. It appears to not be designed for mass distribution. The samples with a hardcoded public key appear to be compiled for the target with a unique key for each target. Otherwise the decryptor sold by the threat actor could be used for all victims. The samples that fetch the public key and ransom note from the C2 server, also send a request when it starts and when it is done. This is probably used to provide the threat actor with live feedback. The request does not include any identifiable information for the threat actor to discern multiple targets.</p><p>The threat actor targets QNAP NAS devices that are used for file storage and backups. It is not common for these devices to run antivirus products and currently the samples are only detected by 2-3 products on VirusTotal, Figure 6, which allows the ransomware to run uninhibited. It is not known how these devices are infected. According to a post on Bleeping Computer’s forum, some infected systems were not fully patched and others reported detections of failed login attempts.</p><p style="text-align: center;"><em><img alt="Low detection rate on VirusTotal" src="https://cdn.filestackcontent.com/ZpQCGUEvTKiL4EEa6ZdD"/><br/> Figure 6 - Low detection rate on VirusTotal</em></p><blockquote><p><em>“During my research, the nas pops me severals time with the message "HTTP Login Failed", like every second.”</em><br/> - zerocool64</p></blockquote><blockquote><p><em>“Seems all of us are using QNAP NAS, which version of QTS where you using at the time of the attack? Mine was 4.1.3”</em><br/> - eggxpert</p></blockquote><blockquote><p><em>“I've found a lot of .encrypt files on my RAID 6 in my QNAP TS-459 Pro II with 4.2.6 firmware”</em><br/> - alew1s3</p></blockquote><blockquote><p><em>“I've activated system registry and suddenly there are a lot of attempts to login via HTTP in my myqnapcloud by strange usernames and IPs so i totally disabled it”</em><br/> - alew1s3</p></blockquote><blockquote><p><em>“Same as someone already explained: lot of login failed that day.”</em><br/> - lucagiroletti</p></blockquote><p style="text-align: center;"><em>Figure 7 - Content from BleepingComputer forum post</em></p><h2>Recommendations</h2><p>Restrict external access to the QNAP NAS device. Ensure it is up to date with security patches and that strong credentials are employed.</p><p>Affected QTS versions according to BleepingComputer forum users:</p><ul><li>4.1.3</li><li>4.2.6 </li><li>QNAP TS-459 Pro II with 4.2.6 firmware</li><li>QNAP TS-251+ (4.3.1.0695 Build 20180830)</li></ul><h3>Yara rule</h3><pre> rule eCh0raix { meta: author = "Anomali" tlp = "GREEN" description = "Rule to detect eCh0raix ransomware" version = "1.0" strings: $magic = "eCh0raix" $s0 = "go.buildid" $s1 = "main.main" $s2 = "makesecret" $s3 = "chDir" $s4 = "writemessage" $s5 = "randSeq" $s6 = "encrypt" condition: uint16(0) == 0x457f and $magic and all of ($s*) }</pre><h3>Bitcoin addresses</h3><p>18C28bVEctVtVbwNytt4Uy6k7wxpysdDLH</p><p>1Fx7jev3dvHobdK8m3Jk6cA8SrfzjjLqvM</p><h3>Samples</h3><p>154dea7cace3d58c0ceccb5a3b8d7e0347674a0e76daffa9fa53578c036d9357 (DE)</p><p>3d7ebe73319a3435293838296fbb86c2e920fd0ccc9169285cc2c4d7fa3f120d (TW)</p><p>95d8d99c935895b665d7da2f3409b88f ( linux_cryptor)</p><h3>URLs</h3><p>http://sg3dwqfpnr4sl5hh[.]onion/api/GetAvailKeysByCampId/13</p><p>http://sg3dwqfpnr4sl5hh[.]onion/order/1LWqmP4oTjWS3ShfHWm1UjnvaLxfMr2kjm</p><p>http://sg3dwqfpnr4sl5hh[.]onion/static/</p><h3>IP</h3><p>192.99.206.61:65000</p><h3>MITRE ATT&CK TTPs:</h3><ul><li><a href="https://attack.mitre.org/techniques/T1190/" target="_blank">Exploit Public-Facing Application - T1190</a></li><li><a href="https://attack.mitre.org/techniques/T1203/" target="_blank">Exploitation for Client Execution - T1203</a></li><li><a href="https://attack.mitre.org/techniques/T1110/" target="_blank">Brute Force - T1110</a></li><li><a href="https://attack.mitre.org/techniques/T1090/" target="_blank">Connection Proxy - T1090</a></li><li><a href="https://attack.mitre.org/wiki/Technique/T1188" target="_blank">Multi-hop Proxy - T1188</a></li><li><a href="https://attack.mitre.org/techniques/T1071/" target="_blank">Standard Application Layer Protocol - T1071</a></li><li><a href="https://attack.mitre.org/techniques/T1095/" target="_blank">Standard Non-Application Layer Protocol - T1095</a></li><li><a href="https://attack.mitre.org/techniques/T1486/" target="_blank">Data Encrypted for Impact - T1486</a></li><li><a href="https://attack.mitre.org/techniques/T1489/" target="_blank">Service Stop - T1489</a></li></ul>