{"id":7777,"date":"2017-05-29T12:10:14","date_gmt":"2017-05-29T20:10:14","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/05\/29\/news-1562\/"},"modified":"2017-05-29T12:10:14","modified_gmt":"2017-05-29T20:10:14","slug":"news-1562","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/05\/29\/news-1562\/","title":{"rendered":"A stolen version of DMA Locker is making the rounds"},"content":{"rendered":"<p><strong>Credit to Author: Malwarebytes Labs| Date: Mon, 29 May 2017 14:21:41 +0000<\/strong><\/p>\n<p>Ransomware has become a popular criminal business with a relatively easy entrance. Even the people with little technical knowledge can build their own ransomware based on open source code, that has been published on the internet some time ago. Nevertheless, cybercriminals keep stealing, not only from victims, but also from each other. Some time ago we heard about\u00a0<a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/petrwrap-ransomware-is-a-petya-offspring-used-in-targeted-attacks\/\" target=\"_blank\" rel=\"noopener noreferrer\">PetrWrap<\/a> &#8211; a ransomware build upon a binary of the infamous Petya. But that is not\u00a0 the only case. For some time, we have been\u00a0observing a <a href=\"https:\/\/blog.malwarebytes.com\/glossary\/threat-actor\/\" target=\"_blank\" rel=\"noopener noreferrer\">threat actor<\/a> who distributes patched DMA Locker binaries.<\/p>\n<h3>Real or stolen DMA Locker &#8211; why would you\u00a0care?<\/h3>\n<p>The observed samples of the stolen version of DMA Locker\u00a0have been built based on one and the same instance of DMA Locker &#8211; so, they\u00a0carry inside the same public key. This implies, that all the victims of this version can get their data back with the help of the same private key. And now comes the best part: we have this key and we distribute it for free to all affected persons.<\/p>\n<p><em>If you are a victim of the fake DMA Locker, you can send e-mail with samples of you encrypted files to: hasherezade-at-gmail.com<\/em><\/p>\n<h3>How to recognize the stolen versions?<\/h3>\n<p>Since the fake DMA Locker is based on the binary of the original DMA Locker 3.0, they have exactly the same GUI &#8211; only the keywords referring to DMA Locker has been removed:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-18130\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/05\/dma_fake-1.png\" alt=\"\" width=\"997\" height=\"734\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/05\/dma_fake-1.png 997w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/05\/dma_fake-1-300x221.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/05\/dma_fake-1-600x442.png 600w\" sizes=\"auto, (max-width: 997px) 100vw, 997px\" \/><\/p>\n<p>The main difference between the original and stolen DMA Locker is a different marker at the beginning of the encrypted file. While the real DMA Locker prefixes content with: !DMALOCK, the stolen version have many different prefix patterns. Some we have\u00a0observed are:<\/p>\n<ul>\n<li>!XPTLOCK5.0<\/li>\n<li>!Locked#2.0<\/li>\n<li>!Locked!###<\/li>\n<li>!Encrypt!##<\/li>\n<\/ul>\n<p>However, the threat actor changes them periodically &#8211; so, anything that is different\u00a0from the standard pattern may suggest that we are dealing with the &#8220;pirated&#8221;, decryptable version.<\/p>\n<p>Example of file encrypted by the fake DMA Locker:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-18123\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/05\/prefix.png\" alt=\"\" width=\"631\" height=\"215\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/05\/prefix.png 631w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/05\/prefix-300x102.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/05\/prefix-600x204.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/05\/prefix-630x215.png 630w\" sizes=\"auto, (max-width: 631px) 100vw, 631px\" \/><\/p>\n<h3>What are\u00a0the chances to get the data back?<\/h3>\n<p>Up to now we managed to help 100% of the known victims of the fake DMA Locker. So far, the threat actor responsible for distributing it, has not changed the key &#8211; so, the prospects of getting data back are still big. However, the chance to get help drastically shrink in case you were attacked with the legitimate DMA Locker, which\u00a0may look the same at first sight.<\/p>\n<h3>How to prevent the attack?<\/h3>\n<p>Distributors of the fake (as well as the original) DMA Locker enter the victim machine via hacked Remote Desktop. Thus, we recommend paying attention if you\u00a0have Remote Desktop\u00a0open and if so, if it is properly secured.<\/p>\n<h3>Analyzed sample<\/h3>\n<p><a href=\"https:\/\/www.reverse.it\/sample\/38527d20338fb35717b349176b976610465d368123c083fb88115e982b367918?environmentId=100\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/www.reverse.it\/sample\/38527d20338fb35717b349176b976610465d368123c083fb88115e982b367918?environmentId=100<\/a> &#8211; fake DMA Locker, adding &#8220;!Encrypt!##&#8221; prefix.<\/p>\n<h3>Appendix<\/h3>\n<p>Currently in distribution is version 3.0 of DMALocker, since the development of 4.0 was abandoned. Read more about our research:<\/p>\n<blockquote data-secret=\"JTWzg9KqOz\" class=\"wp-embedded-content\">\n<p><a href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2016\/05\/dma-locker-4-0-known-ransomware-preparing-for-a-massive-distribution\/\">DMA Locker 4.0: Known ransomware preparing for a massive distribution<\/a><\/p>\n<\/blockquote>\n<p><iframe loading=\"lazy\"  src=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2016\/05\/dma-locker-4-0-known-ransomware-preparing-for-a-massive-distribution\/embed\/#?secret=JTWzg9KqOz\" width=\"100%\" height=\"420\" frameborder=\"0\" ><\/iframe> <\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/malware\/2017\/05\/stolen-version-dma-locker-making-rounds\/\">A stolen version of DMA Locker is making the rounds<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/malware\/2017\/05\/stolen-version-dma-locker-making-rounds\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Malwarebytes Labs| Date: Mon, 29 May 2017 14:21:41 +0000<\/strong><\/p>\n<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/cybercrime\/malware\/2017\/05\/stolen-version-dma-locker-making-rounds\/' title='A stolen version of DMA Locker is making the rounds'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2016\/02\/new_dma_lock.png' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>Pirated versions of DMA-locker are doing the rounds, but there is some good news. All the encrypted data can be decrypted with the same key and we can give it to you.<\/p>\n<p>Categories: <\/p>\n<ul class=\"post-categories\">\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/\" rel=\"category tag\">Cybercrime<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/malware\/\" rel=\"category tag\">Malware<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/malwarebytes-news\/\" rel=\"category tag\">Malwarebytes news<\/a><\/li>\n<\/ul>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/decryptor\/\" rel=\"tag\">decryptor<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/dma-locker\/\" rel=\"tag\">DMA Locker<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/fake\/\" rel=\"tag\">fake<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/xptlock\/\" rel=\"tag\">xptlock<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/cybercrime\/malware\/2017\/05\/stolen-version-dma-locker-making-rounds\/' title='A stolen version of DMA Locker is making the rounds'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/malware\/2017\/05\/stolen-version-dma-locker-making-rounds\/\">A stolen version of DMA Locker is making the rounds<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[4503,10491,12381,11539,3764,10546,12382],"class_list":["post-7777","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-cybercrime","tag-decryptor","tag-dma-locker","tag-fake","tag-malware","tag-malwarebytes-news","tag-xptlock"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/7777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=7777"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/7777\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=7777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=7777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=7777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}