Ransomware as a Service

https://isc.sans.edu/forums/diary/Ransomware+as+a+Service/23277/

by hmhrex • 8 years ago

160 36 8 years ago

isc.sans.edu

blauditore• 8 years ago

I find it somewhat ironic they include a captcha to protect against malicious users.

moate• 8 years ago

Don't want to wind up in an Xzibit moment. "Yo dog, we heard you like ransomware, so we put ransomware in your ransomware so we can steal when you steal!"

TomK32• 8 years ago

That's probably where the real money is to be made...

nercht12• 8 years ago

When you're evil, the first thing you lose is trust in everyone else. After all, if you can stab in the back, what stops others from stabbing you?

johnnycarcin2• 8 years ago

"Based on the strings present in the PE file, it has been written in Go"

I find this kind of interesting. I've seen reports on other malware/virus stuff written in Go recently. I wonder if this is because the ability to cross compile with Go is pretty painless? Or is it because the language is fairly approachable but still allows you to dig a bit "deeper" if you need to?

nothrabannosir• 8 years ago

Maybe it’s a social reason and not a technical one… like, maybe Go is more popular in… some… country… and maybe that country happens to be over represented in… I mean, obviously not. Of course.

But maybe…

sincerely• 8 years ago

This sort of comment is pretty frustrating for people who don't already know what you're talking about. What are you trying to say?

tveita• 8 years ago

Beyond assembly code and C, which is used for obvious reasons, malware authors often just use a language they are familiar with, like any other developer. Lots of malware has been written in Delphi, which has been popular in Eastern Europe, and even some in Visual Basic.

w8rbt• 8 years ago

In addition to easy cross compiling, being able to easily link statically is another nice feature of Go. You get one executable that has everything it needs to run.

SuperPaintMan• 8 years ago

That's exactly why I chose it when I made a PoC ransomware. That and using a virtual file system that bundles all assets into the executable, having a decent stdlib, tons of well written libraries and being able to cross-compile with ease.

karrotwaltz• 8 years ago

The business model behind the service is simple: the bad guys keep 10% of the ransom.

Creating a ransomware is indeed not a very nice thing to do, but IMO the ones that deserve the most to be called "bad guys" are the ones that actually spread the binary (so, the ones that keep the other 90%)

philipov• 8 years ago

They're all bad guys, brent.

ghostbrainalpha• 8 years ago

Nooooooo........

We just like the marching, and the boots, and the hats.

jacquesm• 8 years ago

I'm ok with calling them both bad guys.

ourmandave• 8 years ago

So, like an arms dealer that will sell to anyone?

cocoa19• 8 years ago

I was thinking of that analogy as well. With weapons, you can claim it is for self defense.

I guess some people will argue that releasing ransomware will make software developers study the different types of attacks, so they increase security in computer systems.

ikeboy• 8 years ago

Communications with the C2 server are performed via HTTPS: kdvm5fd6tn6jsbwh[.]onion[.]to (185[.]100[.]85[.]150) located in Romania.

That's just a tor tunnel, IP and location doesn't matter.

colonelxc• 8 years ago

They also posted a bunch of hashes for a file which was customized for them, and then remarked that virustotal hadn't seen it.

Though it does make me think that it would be a good trick to offer this 'service', but then keep all the proceeds (everyone gets the same ransomware download). Maybe less profitable on the long term though.

slig• 8 years ago

They also posted a bunch of hashes for a file which was customized for them, and then remarked that virustotal hadn't seen it.

Surely antivirus are not just trying to match the SHA1 of executables with SHA1 of known virus/malware, otherwise it would be trivial to bypass them.

ryanlol• 8 years ago

The hashes are used to downlod the samples from various sources, not as IoC.

btx• 8 years ago

Interestingly it does not seem to be a new concept: https://www.reddit.com/r/netsec/comments/37ko5v/introducing_... https://securingtomorrow.mcafee.com/mcafee-labs/meet-tox-ran...

They used to take 20% 'commission'.

JumpCrisscross• 8 years ago

I'm waiting for something like this to take the form of an Ethereum smart contract.

hellbanner• 8 years ago

Yes. Automated trading is going to bring about many terrifying things, unfortunately.

Ransomware as a Service

Related Stories