Author Topic: Open Source Ransomware on GitHub  (Read 1677 times)

0 Members and 1 Guest are viewing this topic.

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
Open Source Ransomware on GitHub
« on: August 18, 2015, 02:28:38 pm »
utkusen published an open-source C# ransomware called Hidden Tear.

https://github.com/utkusen/hidden-tear

This fits perfectly to our current discussion what knowledge we should share and what we shouldn't.
Now in this case the horse has already left the barn and it might be interesting for you to see the code.

Offline Kulverstukas

  • Administrator
  • Zeus
  • *
  • Posts: 6627
  • Cookies: 542
  • Fascist dictator
    • View Profile
    • My blog
Re: Open Source Ransomware on GitHub
« Reply #1 on: August 18, 2015, 05:33:22 pm »
This is pretty basic, clever anyway. Ransomware found in the wild are much more sophisticated, right?

Also this is good:

"Send me some bitcoins or kebab"

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
Re: Open Source Ransomware on GitHub
« Reply #2 on: August 18, 2015, 10:01:41 pm »
This is pretty basic, clever anyway. Ransomware found in the wild are much more sophisticated, right?

Also this is good:

"Send me some bitcoins or kebab"

You find both, sophisticated ransomware like CryptoWall 3.0 and CTBLocker, but also crap ones like Encryptor RaaS or the now dead Locker Ransomware (the one where the author said he is sorry about writing it, see here: http://pastebin.com/1WZGqrUH ).
Some of the crappy ones copy the good ones to in the hopes that no one detects that they can be circumvented.

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
Re: Open Source Ransomware on GitHub
« Reply #3 on: August 19, 2015, 08:03:14 am »
Interestingly all of the journalists assume that this is the first open source ransomware on Github.
But I found this written in C from 2013: https://github.com/kholia/smaFS/tree/master/src/tests/Ransomware

Offline Kulverstukas

  • Administrator
  • Zeus
  • *
  • Posts: 6627
  • Cookies: 542
  • Fascist dictator
    • View Profile
    • My blog
Re: Open Source Ransomware on GitHub
« Reply #4 on: August 19, 2015, 08:50:57 am »
<...> the one where the author said he is sorry about writing it, see here: http://pastebin.com/1WZGqrUH ) <...>
So I guess the author got caught and beat up pretty badly :D as I read CTBLocker was much more complex, it used Tor as proxy servers, used a bunch of them as CnC servers.

Offline queryFrequency

  • aka queerFrequency
  • Serf
  • *
  • Posts: 46
  • Cookies: -12
    • View Profile
Re: Open Source Ransomware on GitHub
« Reply #5 on: September 02, 2015, 05:07:16 pm »
A language that has dependencies I wouldn't say is good for malware development.

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
Re: Open Source Ransomware on GitHub
« Reply #6 on: September 03, 2015, 11:42:19 am »
A language that has dependencies I wouldn't say is good for malware development.

A language does not have dependencies, a language is nothing more than a way to describe something. The implementation that you use for that language determines the dependencies for the executable. E.g., there exist numerous interpreters for C and C++, and GJC can compile Java to native code.

But if you rephrase your statement to the program or executable itself, it is still a weird statement.
There is not a single program that does not have dependencies. You have file format dependencies, OS dependencies, OS version dependencies, interpreted environment dependencies (that includes Macro malware which is pretty successful atm), language dependencies (meaning the language that is set for the OS. Some macro commands for MS Office were actually localized and only available for that one language in the past), vulnerability dependencies (for malware that uses exploits), etc etc.

Think about it.
You may have architectural and OS independent executables, which are dependent on an interpreter or a virtual machine. Most people who speak of "language dependencies" are referring to these.
You may have native code (which you probably consider without dependencies), but those executables only run on one architecture and one operating system. So they are in fact very limited and dependent on them.

Either way you have pros and cons. Calling the first example dependent and the latter independent makes no sense.  It is a question of how widespread the "dependencies" are and what the actual target of the attacker is.

This is a pretty good picture by Szor that visualizes some malware dependencies:




Offline queryFrequency

  • aka queerFrequency
  • Serf
  • *
  • Posts: 46
  • Cookies: -12
    • View Profile
Re: Open Source Ransomware on GitHub
« Reply #7 on: September 03, 2015, 03:53:12 pm »
Did some further research from what you have said, I understand what you're saying. Thanks for the in-depth explanation.