• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Malware   »   CryptoLocker: Its Spam and ZeuS/ZBOT Connection

CryptoLocker: Its Spam and ZeuS/ZBOT Connection

  • Posted on:October 21, 2013 at 11:06 am
  • Posted in:Malware
  • Author:
    Kervin Alintanahin (Threats Analyst)
5

CryptoLocker, the latest strain of ransomware, is best known for trying to force users into paying a fee by encrypting certain files and then later offering a $300 decrypting tool. In this entry, we discuss how it arrives and how it is connected with other malware, most notably ZBOT/ZeuS.

We reported earlier that CryptoLocker malware not only blocks access to the infected system, but also forces users to buy a $300 decrypting tool by encrypting certain files. Recently, we were alerted to a spam campaign that we determined to be responsible for CryptoLocker infections. The spammed messages contain malicious attachments belonging to TROJ_UPATRE, a malware family characterized by its having small file size and a simple downloading function.

Using feedback provided by the Trend Micro Smart Protection Network, we searched for information linking CryptoLocker ransomware to this downloader and found a sample email containing a malicious attachment (detected as TROJ_UPATRE.VNA):

Figure 1. Screenshot of spam with malicious attachment

Once this attachment is executed, it downloads another file which is saved as cjkienn.exe (detected as  TSPY_ZBOT.VNA). This malware then downloads the actual CryptoLocker malware (detected as TROJ_CRILOCK.NS).

Figure 2. CryptoLocker infection chain

This threat is particularly troublesome for several reasons. First, ZeuS/ZBOT variants are known to steal information related to online banking credentials. The attackers can use the stolen information to start unauthorized banking transactions. Furthermore, because of the CryptoLocker malware, users will be unable to access their personal or important documents.

Notes on CryptoLocker Encryption

Although the ransom note in CryptoLocker only specifies “RSA-2048” as the encryption used, our analysis shows that the malware uses AES + RSA encryption.

RSA is asymmetric key cryptography, which means it uses two keys. One key is used to encrypt the data and another is used to decrypt the data. (One key is made available to any outside party and is called the public key; the other is kept by the user and is called the private key.) AES uses symmetric keys (i.e., the same key is used to encrypt and decrypt information.)

The malware uses an AES key to encrypt files.  The AES key for decryption is written in the files encrypted by the malware. However, this key is encrypted with an RSA public key embedded in the malware, which means that a private key is needed to decrypt it. Unfortunately, the said private key is not available.

For information on which files are encrypted, users can check their system’s autostart registry.

registry-editor-cryptolocker

Figure 3. List of encrypted files as seen on system’s registry

Trend Micro Solutions for CryptoLocker

Trend Micro’s web reputation service detects the DGA-created URLs. If the malware is unable to connect to these URLs, it will not receive the public key, thus preventing the malware from encrypting files. In addition, Trend Micro’s behavior-based detection monitors the system for CryptoLocker infection. If configured properly, it prevents the malware from executing.

Trend Micro Protection-Cryptolocker

Figure 4. Trend Micro detects the related malware

It is also important for users to be cautious when opening any attachments from email messages coming from unknown sources. Our existing email reputation service also blocks spam messages related to this threat.

Update as of 5:15 PM PST, Nov. 12, 2013:

It seems that the cybercriminals responsible for the spate of UPATRE attacks have now set their sights on security vendors. Earlier today, we received a spammed email sample with a malicious attachment, one that comes in the form of a password-protected archive. The password itself is provided in the email body text, along with instructions on how to use the supposed contents.

Figure 5. Screenshot of spam with malicious attachment

What made this latest attack noteworthy is how the password is included with the message, making it look and read more legitimate and non-malicious. Of course, the attachment is verified as malware and detected as TROJ_UPATRE.CI.

With additional insights from Benson Sy and Erika Mendoza. 

Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»
Tags: cryptolockerransomwareSpamTrend Micro solutionZBOTZeuS

Security Predictions for 2020

  • Cybersecurity in 2020 will be viewed through many lenses — from differing attacker motivations and cybercriminal arsenal to technological developments and global threat intelligence — only so defenders can keep up with the broad range of threats.
    Read our security predictions for 2020.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • Our New Blog
  • How Unsecure gRPC Implementations Can Compromise APIs, Applications
  • XCSSET Mac Malware: Infects Xcode Projects, Performs UXSS Attack on Safari, Other Browsers, Leverages Zero-day Exploits
  • August Patch Tuesday Fixes Critical IE, Important Windows Vulnerabilities Exploited in the Wild
  • Water Nue Phishing Campaign Targets C-Suite’s Office 365 Accounts

Popular Posts

Sorry. No data so far.

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.