Alert: New version of DEADMIN LOCKER Ransomware

<div><div style="text-align: justify;">Sangfor Technologies Security Lab (aka Quianlimu) has discovered a new version of an old ransomware used to attack Chinese enterprises. After attackers’ initial compromise of an internal jump server via brute-forcing, the invading malware uses a toolkit to infect hosts across the internal network and deliver the ransomware to encrypt files. The ransomware appends encrypted files with hardcoded suffix “.[[email protected]].DEADMIN” and [email protected] is the email address to contact hackers. In the ransom demand, attackers identify themselves as DEADMIN LOCKER. At the time of writing, there is no decryption tool for this ransomware.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 01" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-01.png"/></div><div style="text-align: justify;">The toolkit obtained from infected hosts includes password collector, remote login tool and other attacking tools, such as AutoMIMI, Lazy, rdp_con, gmer, and even “!RDP” which is used to launch remote desktop connections. </div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 02" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-02.png"/></div><div style="text-align: justify;"><strong>Toolkits</strong><br/>
Password interception tools: AutoMIMI, mimi, netpass64.exe, and Lazy<br/>
Intranet scanning tools: masscan, !PortScan, Advanced_Port_Scanner, and NetworkShare<br/>
Brute-force attack tools: NLBrute<br/>
Remote access tools: psexec, !RDP, and rdp_con<br/>
Antivirus evasion tools: gmer, PCHunter64, PowerTool, PowerTool_64, and ProcessHacker64<br/><br/><strong>Intrusion Tracking</strong><br/>
1. During a live attack, Sangfor security consultants analyzed the security logs of multiple encrypted hosts and found login records from an internal host (later referred to as the “jumper server”) in the events of all ransom notes generated by infected hosts.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 03" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-03.png"/></div><div style="text-align: justify;">2. The jump server was then investigated and the initial attack toolkit containing the intranet scanners and remote access tools was found.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 04" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-04.jpg"/></div><div style="text-align: justify;">3. Analysis of the jump server security logs, looking at the time when the ransom notes were generated, found a public IP address (92.246.76.125). This IP address was previously marked as malicious in the Sangfor threat intelligence Neural-X platform.<br/><br/>
4. Before this attack, Sangfor discovered that the jump server had successfully been brute-forced before. According to the logs, more than ten IP addresses had been used to successfully log in. Most of them were detected as malicious IP addresses based on threat intelligence. That is to say, the host had become a hacking target a long time ago.<br/><br/><strong>The Penetration Tool Analysis</strong><br/>
We simulated and profiled the penetration behaviors against the internal network:<br/><br/>
1. After local privilege escalation, hackers used mimikatz to intercept the login password of a host, using an automated script, launch.vbs, to simplify password interception.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 05" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-05.png"/></div><div style="text-align: justify;">2. Hackers then added the passwords to a password dictionary because many administrators often use the same password on multiple servers, which makes password cracking easier.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 06" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-06.png"/></div><div style="text-align: justify;">3. A port scanner was used to scan the internal network, and locate hosts with open ports 445 and 3389.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 07" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-07.png"/></div><div style="text-align: justify;">4.  For hosts with port 3389 open, hackers used NLBrute to brute force login account username and password.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 08" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-08.png"/></div><div style="text-align: justify;">5. For hosts with open port 445 only, hackers attempted to obtain user credentials by launching brute-force attacks.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 09" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-09.png"/></div><div style="text-align: justify;">6. Once compromised, psexec was used to upload a script to target hosts to start an RDP service.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 10" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-10.png"/></div><div style="text-align: justify;">7. After obtaining usernames and passwords of successfully brute forced hosts, hackers used rdp_con tool to connect to them.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 11" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-11.png"/></div><div style="text-align: justify;">8. When rdp_con connected to the victim hosts, hackers uploaded a series of antivirus evasion tools to terminate antivirus software, and finally run the ransomware. At this point, the entire intrusion process is completed.<br/><br/><strong>Ransomware Analysis</strong><br/>
1. Ransomware file uses UPX to pack itself.  After being executed, it calls Winexec to delete the shadow disk volume to prevent users from restoring data. </div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 12" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-12.png"/></div><div style="text-align: justify;">2. Termination of the following service to ensure encryption process:<br/>
vmickvpexchange, vmicguestinterface, vmicshutdown, vmicheartbeat, vmicrdv, storflt, vmictimesync, vmicvss, MSSQLFDLauncher, MSSQLSERVER, SQLSERVERAGENT, SQLBrowser, SQLTELEMETRY, MsDtsServer130, SSISTELEMETRY130, SQLWriter, MSSQL, SQLAgent, MSSQLServerADHelper100, MSSQLServerOLAPService, MsDtsServer100, ReportServer, TMBMServer, postgresql-x64-9.4, UniFi, vmms, sql-x64-9.4, UniFi, vmms<br/><br/>
3. Traverse processes to terminate the following: <br/>
sqlbrowser.exe, sqlwriter.exe, sqlservr.exe, msmdsrv.exe, MsDtsSrvr.exe, sqlceip.exe, fdlauncher.exe, Ssms.exe, sqlserv.exe, oracle.exe, ntdbsmgr.exe, ReportingServecesService.exe, fdhost.exe, SQLAGENT.exe, ReportingServicesService.exe, msftesql.exe, pg_ctl.exe, postgres.exe, UniFi.exe, sqlagent.exe, ocssd.exe, dbsnmp.exe, synctime.exe, mydesctopservice.exe, ocautoupds.exe, agntsvc.exe, agntsvc.exe, agntsvc.exe, encsvc.exe, firefoxconfig.exe, tbirdconfig.exe, ocomm.exe, mysqld.exe, mysqld-nt.exe, mysqld-opt.exe, dbeng50.exe, sqbcoreservice.exe, excel.exe, infopath.exe, msaccess.exe, mspub.exe, onenote.exe, outlook.exe, powerpnt.exe, steam.exe, thebat.exe, thebat64.exe, thunderbird.exe, visio.exe, winword.exe, wordpad.exe, erbird.exe, visio.exe, winword.exe, wordpad.exe<br/><br/>
4. Generate an AES secret key, use RSA to encrypt the AES secret key, and then use AES algorithm to encrypt file. </div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 13" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-13.png"/></div><div style="text-align: justify;">5. Create a .txt ransom note on desktop and drop it under each root directory during directory traversal and encryption:</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 14" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-14.png"/></div><div style="text-align: justify;">6. Traverse and encrypt disks. Determine whether directory under C drive is system directory.   If it is system directory, skip it.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 15" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-15.png"/></div><div style="text-align: justify;">7. Delete itself after encryption:</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 16" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-16.png"/></div><div style="text-align: justify;"><strong>Solutions</strong><br/>
At the time of writing, there is no decryption tool for this ransomware. You must isolate infected hosts and disconnect them from network. Sangfor recommends performing virus scans on all systems to locate and removal the malware as soon as possible.<br/><br/><br/><strong>Detection and Removal</strong><br/>
1. Sangfor Ransomware Protection Solution, based on the Sangfor’s NGAF and Endpoint Secure products, is capable of detecting and removing this ransomware virus.</div><div style="text-align: center;"><img alt="Alert New version of DEADMIN LOCKER Ransomware 17" src="/sites/default/files/inline-images/Cyber-Security/Alert-New-version-of-DEADMIN-LOCKER-Ransomware-17.png"/></div><div style="text-align: justify;">2. Sangfor offers customers and users free anti-malware software to scan for, and remove the ransomware. It can be downloaded from:<br/>
Package for 64-bit Windows: <br/><a href="https://www.sangfor.com/Uploads/File/SfabAntiBot1.1.0.105.zip&quot; rel="noopener noreferrer" target="_blank"><span style="text-decoration: underline; color: #337fe5;">Anti-Malware Software</span></a><br/><br/><strong>Protection</strong><br/>
1. Patch Windows to remove open vulnerabilities.<br/>
2. Back up critical data files regularly to other hosts or storage devices.<br/><strong>NOTE: This is the single easiest way to defeat ALL ransomware!</strong><br/>
3. Change and strengthen your computer passwords and do not use the same passwords for different computers, to avoid compromising multiple systems.<br/>
4. Do not click on any email attachment or included web link from unknown sources or download any software from untrusted websites.<br/>
5. Disable unnecessary file sharing.<br/>
6. Disable RDP if not needed.<br/><br/><strong>Solution for Sangfor Customers</strong><br/>
1. When an DEADMIN LOCKER attack is found, Sangfor NGAF or Endpoint Secure should block ports 3389 and 445 to stop ransomware from spreading.<br/>
2. Sangfor NGAF and Endpoint Secure can prevent brute-force attacks. Turn on brute-force attack prevention on NGAF and enable Rule 11080051, 11080027 and 11080016. Turn on brute-force attack prevention on Sangfor EDR.<br/>
3. Schedule Sangfor Endpoint Secure to run both virus and vulnerability scans on all endpoints. <br/>
4. For Sangfor NGAF customers, update NGAF to version 8.0.5 or higher and enable AI-based Sangfor Engine Zero to identify incoming malware.<br/>
5. Sangfor Endpoint Secure can identify most popular hack tools, and block and disable them when detected. For Sangfor Endpoint Secure customers, enable ransomware prevention to block ransomware. <br/>
6. Make sure all Sangfor security products are connected to cloud-based Sangfor Neural-X Threat Intelligence, to detect new threats.<br/>
7. Subscribe to Sangfor Security Operations HealthCheck services to audit your existing security deployment by reviewing current security policies, evaluating security threats and risks, scanning for relevant vulnerabilities, and updating policies to enhance your protection.</div><br/></div>