5 ms·

Here's an analysis of the malware - http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-inst

by noondip 11y ago

Here's an analysis of the malware - http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

moyix 11y ago
Nice. That matches what I'm seeing.
Sammi 11y ago
Copy/pasting the helpful parts of that article: How to Protect Yourself Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger. If the Transmission installer was downloaded earlier or downloaded from any third party websites, we also suggest users perform the following security checks. Users of older versions of Transmission do not appear to be affected as of now. We suggest users take the following steps to identify and remove KeRanger holds their files for ransom: 1. Using either Terminal or Finder, check whether /Applications/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission. 2. Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_service” is running. If so, double check the process, choose the “Open Files and Ports” and check whether there is a file name like “/Users/<username>/Library/kernel_service” (Figure 12). If so, the process is KeRanger’s main process. We suggest terminating it with “Quit -> Force Quit”. 3. After these steps, we also recommend users check whether the files “.kernel_pid”, “.kernel_time”, “.kernel_complete” or “kernel_service” existing in ~/Library directory. If so, you should delete them.
- why-el 11y ago
  You have a typo: "Applicaions". Usually not a problem but in this case it will say "No file/folder found" when it's just a typo.
  - Sammi 11y ago
    Thanks. Fixed it. I only copy/pasted originally though :)
vmorgulis 11y ago
"It will then sleep for three days. Note that, in a different sample of KeRanger we discovered, the malware also sleeps for three days, but also makes requests to the C2 server every five minutes." It's fascinating!
- Matt3o12_ 11y ago
  Isn't it possible to fire a takedown notice to that server? I mean KeRanger committed a felony and Amazon (assuming you mean Amazon's EC2 server) might react quickly if they realize what has happened. It might save a lot of computers from getting destroyed. As long as the server is somewhere in the Western world, it should not be a problem.
  - moyix 11y ago
    The server isn't on EC2, it's hosted on Tor. The malware uses an HTTP-to-TOR gateway service (onion.nu and onion.link) to pull down the encryption key and README file from one of three different hidden services. In theory you could try to get the gateways to block the connections, but I'm not sure they're likely to be cooperative.
  - vmorgulis 11y ago
    It's a "Command-and-Control" server (C&C or C2). https://en.wikipedia.org/wiki/Command_and_control_%28malware%29 https://en.wikipedia.org/wiki/Command_and_control_%28malware... I just learned that too. For me, C&C reminds me "Command and Conqueer" (the game). https://en.wikipedia.org/wiki/Command_%26_Conquer https://en.wikipedia.org/wiki/Command_%26_Conquer
    - Matt3o12_ 11y ago
      Thanks, I just realized it after reading Claud Xiao and Jin Chen's analysis, too. Apparently, this ransomware uses Tor to hide its origin. Analysis: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

by noondip 11y ago

moyix 11y ago

Nice. That matches what I'm seeing.

Sammi 11y ago

Copy/pasting the helpful parts of that article: How to Protect Yourself Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger. If the Transmission installer was downloaded earlier or downloaded from any third party websites, we also suggest users perform the following security checks. Users of older versions of Transmission do not appear to be affected as of now. We suggest users take the following steps to identify and remove KeRanger holds their files for ransom: 1. Using either Terminal or Finder, check whether /Applications/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission. 2. Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_service” is running. If so, double check the process, choose the “Open Files and Ports” and check whether there is a file name like “/Users/<username>/Library/kernel_service” (Figure 12). If so, the process is KeRanger’s main process. We suggest terminating it with “Quit -> Force Quit”. 3. After these steps, we also recommend users check whether the files “.kernel_pid”, “.kernel_time”, “.kernel_complete” or “kernel_service” existing in ~/Library directory. If so, you should delete them.

why-el 11y ago
You have a typo: "Applicaions". Usually not a problem but in this case it will say "No file/folder found" when it's just a typo.
- Sammi 11y ago
  Thanks. Fixed it. I only copy/pasted originally though :)

vmorgulis 11y ago

"It will then sleep for three days. Note that, in a different sample of KeRanger we discovered, the malware also sleeps for three days, but also makes requests to the C2 server every five minutes." It's fascinating!

Matt3o12_ 11y ago
Isn't it possible to fire a takedown notice to that server? I mean KeRanger committed a felony and Amazon (assuming you mean Amazon's EC2 server) might react quickly if they realize what has happened. It might save a lot of computers from getting destroyed. As long as the server is somewhere in the Western world, it should not be a problem.
- moyix 11y ago
  The server isn't on EC2, it's hosted on Tor. The malware uses an HTTP-to-TOR gateway service (onion.nu and onion.link) to pull down the encryption key and README file from one of three different hidden services. In theory you could try to get the gateways to block the connections, but I'm not sure they're likely to be cooperative.
- vmorgulis 11y ago
  It's a "Command-and-Control" server (C&C or C2). https://en.wikipedia.org/wiki/Command_and_control_%28malware%29 https://en.wikipedia.org/wiki/Command_and_control_%28malware... I just learned that too. For me, C&C reminds me "Command and Conqueer" (the game). https://en.wikipedia.org/wiki/Command_%26_Conquer https://en.wikipedia.org/wiki/Command_%26_Conquer
  - Matt3o12_ 11y ago
    Thanks, I just realized it after reading Claud Xiao and Jin Chen's analysis, too. Apparently, this ransomware uses Tor to hide its origin. Analysis: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...