Introduction

In a recent incident response case, we dealt with a variant of the Mimic ransomware with some interesting customization features. The attackers were able to connect via RDP to the victim’s server after a successful brute force attack and then launch the ransomware. After that, the adversary was able to elevate their privileges by exploiting the CVE-2020-1472 vulnerability (Zerologon).

The identified variant abuses the Everything library and provides an easy-to-use GUI for the attacker to customize the operations performed by the malware. It also has features for disabling security mechanisms and running system commands.

This ransomware variant is named “Elpaco” and contains files with extensions under the same name. In this post, we provide details about Elpaco, besides already shared, as well the tactics, techniques and procedures (TTPs) employed by the attackers.

Analysis

First look at the sample

Our analysis started with a basic inspection of the sample. First, we verified its properties, such as the file type, strings and capabilities, as shown in the images below.

File type analysis

Interestingly enough, the malware used a 7-Zip installer mechanism, so it was classified as packed by most malware analysis tools and raised suspicions with detection tools.

File properties analysis

Entropy analysis

We inspected the file as a ZIP and found that the sample abused the Everything library, a legitimate filename search engine that provides fast searching and real-time updates by indexing files in Windows systems.

Malware archive contents

The artifact abused this library in similar ways to the Mimic ransomware discovered earlier by TrendMicro: it contained legitimate Everything applications (
Everything32.dll and Everything.exe) and a password-protected archive with malicious payloads, named Everything64.dll. The remaining file inside the archive was a legitimate 7-Zip utility for extracting the malicious archive contents. The Mimic ransomware searches for specific files using Everything APIs, encrypts user data, demands ransom payments, and exhibits sophisticated features like multi-threaded encryption to speed up the attack. Mimic also avoids detection by obfuscating its code, which makes it harder for security tools to detect and block the attack.
By analyzing Elpaco strings, we were able to identify the command used to extract the
Everything64.dll file, including its password.2e434 RunProgram="hidcon:7za.exe x -y -p7183204373585782 Everything64.dll"

7-Zip extraction command

When executed, the malware unpacked the archive and dropped the necessary files into the
%AppData%\Local directory, inside a separate directory with a randomly generated UUID as the name.C:\Users\user\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\
Destination directory

Sample contents

The archive contents are required for encrypting files and performing additional tasks in the operating system.

Elpaco structure

For example, the
DC.exe binary is the Defender Control tool for enabling and disabling Windows Defender. It is triggered by the sample once unpacked.

Defender Control (DC.exe) software

The sample also drops a file called
session.tmp into the same destination directory. This is a session key for resuming encryption if the malicious process is interrupted, as by a process kill.

session.tmp file

However, the most interesting artifact is
svhostss.exe, which is the main console used by the malware. It is worth mentioning that this name closely mimics svchost.exe, a legitimate Windows process. This naming pattern is often used by threat actors to confuse less experienced individuals during memory analysis. The svhostss.exe file is indeed the binary that performs malicious instructions. The malware comes with a GUI under the name gui40.exe, located in the same directory. It interacts with the console and facilitates operations like customizing ransomware properties, such as a ransom note or allowed directories/files, and performing actions in the target system.

DC.exe is called during runtime by svhostss.exe, with the /D available command for disabling

In the GUI, the operator can select entire drives for encryption, perform a process injection to hide malicious processes, customize the ransom note, change the encryption extension, set the order of encryption based on the original file format, and exclude specific directories, files or formats from encryption.

Ransomware GUI

Ransom note customization

It is also possible to kill certain processes specified by the operator and execute system commands, all of which makes this threat highly customizable.

Ransomware parameters

Data import and export

The sample allows for the import and export of malware configuration files according to the parameters set by the operator. There are several built-in templates within the malware for the operator to choose from. The image below shows an exported configuration file; note that each configuration is preceded by a number that represents its ID.

Custom configuration file

The console interface, running alongside the GUI, gathers detailed information about the system, including drives and file shares.

Information gathering by svhostss.exe

The malware creates the following registry keys — note that all files with the default
.ELPACO-team extension are classified as “mimicfiles” and configured to open the ransom note (Decryption_INFO.txt).HKLM\SOFTWARE\Classes\.ELPACO-team\: "mimicfile"

HKLM\SOFTWARE\Classes\mimicfile\shell\open\command\: "notepad.exe
"C:\Users\user\AppData\Local\Decryption_INFO.txt""
Also, the artifact configures the
Run registry key to execute svhostss.exe and display the ransom note at startup.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhostss:
""C:\Users\user\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-
C8DF72D8F78A\svhostss.exe""

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhostss.exe: "notepad.exe
"C:\Users\user\AppData\Local\Decryption_INFO.txt""
It is noteworthy that the main binary,
svhostss.exe, lacks significant protection from analysis, so we were able to easily see certain command executions performed by the malware.

Runtime strings

We were also able to find suspicious imports of the functions
FindFirstFileW, WriteFile, FindNextFileW and ShellExecuteW. These are typically used in ransomware samples for file manipulation, while the latter is often used for calling an external program, such as PowerShell, cmd.exe or a third-party component, for deleting the malware.

Function imports

In the case of the Elpaco and Mimic variants, it uses the
SetSearchW function exported from the legitimate Everything DLL to search the victim’s files, as shown in the images below. Interestingly enough, we detected no functions for data exfiltration.

SetSearchW function

Detection and analysis evasion

The artifact encrypts the victim’s files with the stream cipher ChaCha20. The key for this cipher is encrypted by the asymmetric encryption algorithm RSA-4096 — without the key we were unable to decrypt the files.

ChaCha20 call

As shown in the image below, all procedures performed by the ransomware during execution are logged to
C:\temp\MIMIC_LOG.txt. The artifact also drops a copy of the session.tmp key file into the same C:\temp directory.

MIMIC_LOG.txt file

The last step in malware execution is calling the
Del command to delete all executables, configuration files, DLLs, batch files and database-related files in the ransomware directory. Interestingly enough, before deleting, the sample uses the fsutil LOLBin, as shown in the image above, to securely erase svhostss.exe file, without the possibility of its recovery.

YARA rules

Based on our analysis of the sample, we developed the following YARA rules for detecting both the dropper and the console interface used by the GUI. The rules take into account the file type, relevant strings and library imports.

Elpaco dropper:
import "pe"

rule elpaco_dropper
{
meta:
author = "Kaspersky - GERT"
description = "Yara rule for detecting the Elpaco dropper."
target_entity = "file"

strings:
$s1 = "-p7183204373585782" wide ascii nocase
$s2 = "Everything64.dll" wide ascii nocase
$s3 = "ELPACO-team.exe" wide ascii nocase
condition:
(2 of ($s*)) and pe.imports("SHELL32.dll", "ShellExecuteW") and pe.imports("KERNEL32.dll",
"LoadLibraryA")
}
svhostss.exe (console interface):
import "pe"

rule elpaco_console
{
meta:
author = "Kaspersky - GERT"
description = "Yara rule for detecting the Elpaco/Mimic main console."
target_entity = "file"

strings:
$s1 = "powershell.exe -ExecutionPolicy Bypass" wide ascii nocase
$s2 = "Software\\Classes\\mimicfile\\shell\\open\\command" wide ascii nocase
$s3 = "cmd.exe /c DC.exe /D" wide ascii nocase
$s4 = "MIMIC_LOG.txt" wide ascii nocase
$s5 = "mimicfile" wide ascii nocase
$s6 = "Everything Setup..." wide ascii nocase
$s7 = "

Victims

We used these YARA rules on public sources to detect threat actors who had recently used the Elpaco sample and other Mimic variants, mainly in the United States, Russia, the Netherlands, Germany and France. However, their presence was not limited to those countries, with further cases detected in Canada, Romania, South Korea, the United Kingdom and so on.

Top 5 countries targeted by Mimic (download)

The following chart shows the evolution of Mimic appearances per month.

Mimic appearances per month, 2024 (download)

The collected data shows that Mimic variants, including Elpaco, have been used by attackers at least since August 2023.

Conclusion

In this incident, we observed that the Elpaco ransomware is a Mimic variant that abused the Everything DLL, which is used for file discovery. The artifact presented an interesting user interface for customizing its attributes, while allowing the operator to export the parameters to a configuration file. Unfortunately, the encryption algorithm makes it impossible to decrypt the files on an infected machine without the private key, which makes this threat hard to deal with. Another feature of Elpaco is that it deletes itself after encrypting files to evade detection and analysis. We have observed attacks with Elpaco and other Mimic samples on a massive scale, targeting a wide range of countries worldwide, and we’ll continue monitoring this threat.

Kaspersky products detect the threat described in this article with the following verdicts:

• HEUR:Trojan-Ransom.Win32.Generic (dropper).
• HEUR:Trojan-Ransom.Win32.Mimic.gen (svhostss.exe).

Tactics, techniques and procedures

Below are the TTPs identified from our malware analysis.

Indicators of Compromise

• 61f73e692e9549ad8bc9b965e25d2da683d56dc1 (dropper)
• 8af05099986d0b105d8e38f305efe9098a9fbda6 (svhostss.exe)

securelist.com/elpaco-ransomwa…

For a lot of electrical and mechanical machines, there are nominal and peak ratings for energy output or input. If you’re in marketing or advertising, you’ll typically look at the peak rating and move on with your day. But engineers need to know that most things can only operate long term at a fraction of this peak rating, whether it’s a power supply in a computer, a controller on an ebike, or the converter on a wind turbine. But this electric motor system has a unique cooling setup allowing it to function at nearly full peak rating for an unlimited amount of time.

The motor, called the Super Continuous Torque motor built by German automotive manufacturer Mahle is capable of 92% of its peak output power thanks to a unique oil cooling system which is able to remove heat and a rapid rate. Heat is the major limiter for machines like this; typically when operating at a peak rating a motor would need to reduce power output to cool down so that major components don’t start melting or otherwise failing. Given that the largest of these motors have output power ratings of around 700 horsepower, that’s quite an impressive benchmark.

The motor is meant for use in passenger vehicles but also tractor-trailer style trucks, where a motor able to operate at its peak rating would mean a smaller size motor or less weight or both, making them easier to fit into the space available as well as being more economically viable. Mahle is reporting that these motors are ready for production so we should be seeing them help ease the transportation industry into electrification. If you’re more concerned about range than output power, though, there’s a solution there as well so you don’t have to be stuck behind the times with fossil fuels forever.

Thanks to [john] for the tip!

hackaday.com/2024/11/26/electr…

Il presidente di Microsoft ha invitato Donald Trump a peroteggersi contro gli attacchi informatici provenienti da Cina e Iran nel mezzo di un’ondata di attacchi a livello nazionale contro funzionari governativi e campagne elettorali statunitensi.

Brad Smith, che è anche vicepresidente e consigliere generale della società, ha dichiarato al Financial Times che la sicurezza informatica “deve occupare un posto più ampio negli affari internazionali” e ha invitato il presidente eletto degli Stati Uniti a inviare un “messaggio chiaro”.

“Spero che l’amministrazione Trump faccia di più per contrastare gli attacchi informatici sponsorizzati dagli Stati, in particolare da Cina e Iran”, ha affermato Smith. “Non dobbiamo tollerare il livello di attacchi che stiamo vivendo oggi”.

Recentemente, le forze dell’ordine statunitensi hanno accusato la Cina di una massiccia campagna di spionaggio informatico che includeva l’hacking di diverse reti di telecomunicazioni statunitensi nel periodo precedente le elezioni.

Smith ha osservato che l’amministrazione Joe Biden ha compiuto “progressi significativi nel rafforzamento delle difese della sicurezza informatica”, ma ha aggiunto: “È necessario compiere ulteriori passi, in particolare nel prevenire e scoraggiare gli attacchi informatici da altri paesi”.

Secondo una ricerca di Microsoft, i clienti dell’azienda affrontano ogni giorno più di 600 milioni di attacchi informatici. I gruppi criminali e le agenzie governative uniscono sempre più le forze, si scambiano strumenti e conducono operazioni congiunte. A settembre, Smith ha testimoniato davanti al Senato degli Stati Uniti, chiedendo una maggiore interferenza digitale da parte di Cina e Iran nelle elezioni globali del 2024.

Tuttavia, la stessa Microsoft è stata criticata per i suoi scarsi standard di sicurezza. A marzo, il Cybersecurity Council degli Stati Uniti ha pubblicato un rapporto in cui indicava che la cultura della sicurezza dell’azienda era “inadeguata”. Nel 2023, gli hacker cinesi sono riusciti ad accedere a centinaia di account di posta elettronica, compresi quelli di alti funzionari della sicurezza statunitense, ospitati sui sistemi cloud di Microsoft.

In risposta, il CEO di Microsoft Satya Nadella ha affermato che la società intende rendere la sicurezza una priorità assoluta, anche legando la retribuzione dei dipendenti alle prestazioni di sicurezza. L’azienda sta inoltre apportando modifiche al sistema operativo Windows per accelerare il ripristino da incidenti come l’interruzione IT globale di luglio causata da un aggiornamento di sicurezza CrowdStrike non riuscito.

Oltre alle questioni di sicurezza informatica, Smith ha invitato il governo degli Stati Uniti ad “accelerare l’esportazione delle principali tecnologie digitali americane”, in particolare verso il Medio Oriente e l’Africa. Secondo lui i processi devono essere standardizzati in modo che la tecnologia americana possa raggiungere altre parti del mondo con la stessa rapidità della tecnologia cinese.

L'articolo Microsoft Esorta Trump: 600 milioni di cyberattacchi al giorno, il mondo deve reagire! proviene da il blog della sicurezza informatica.

Firenze.
Inveisce Guglielmo Mossuto, capogruppo(*) della Lega in consiglio comunale: "Agenti di Polizia Municipale impiegati per far multe ai commercianti o sequestrare merce agli abusivi. Quando per spaccio, degrado e furti in centro? Basta blitz spot!"

Ma anche basta spritz. O fist fuck.
E diamoci una regolata anche con gli esclamativi.

La #Lega o chi per essa hanno fatto le gonadi a scottadito per decenni all'amministrazione, agli addetti stampa e purtroppo anche alle persone serie, frignando contro chi vendeva borse e poster ai turisti occupandissolopùbbliho e poi i'ddegràdo e l'insihurézza.
Ogni tanto la gendarmeria di Palazzo Vecchio fa il solito pattuglione che sanziona cassettate di incapenti, ma adesso non gli va più bene perché c'è gente -nonostante la propaganda e i campi di concentramento in #Albania- che ai turisti e anche a qualche fiorentino dedica tutt'altre attenzioni. Quindi ci vorrebbe la polizia locale con il #taser, per fare ZAP! contro i négher recalcitranti e portarli tutti subito in prigione, loro e il loro andare in giro che fa calare i prezzi degli immobili.
E sul taser la Lega ha puntato molto; addirittura di più che sugli spruzzini piccanti intesi come indispensabili per la sicurezza femminile.
Gli spruzzini piccanti non si sa quanti stupri abbiano evitato. Di sicuro sono entrati da anni nella panoplia minima del malintenzionato e hanno causato più o meno direttamente almeno undici morti accertati. Otto nel 2018 alla #LanternaAzzurra di #Corinaldo e tre l'anno precedente in Piazza #SanCarlo a #Torino.
Adesso chiunque si interessi dei comunicati stampa di gente che a Firenze non è mai stata parte di alcuna soluzione e che quindi fa di tutto per farsi considerare parte dei problemi, viene a sapere che nel novembre 2024

quattro ragazzi di origine straniera minacciavano a Novoli le persone alla fermata della tramvia con uno strumento a scariche elettrice tipo taser.

Gentilissimo, è lo stesso Guglielmo #Mossuto a far sapere a tutti che adesso anche il taser è entrato nell'uso degli stessi operatori economici che si avvalgono -con buon successo- degli spruzzini piccanti.
La Lega ha conquistato un altro alloro.

(*) A furia di comunicati stampa e di aperitivi con i soliti dieci badolla la Lega è passata a Firenze dagli oltre venticinquemila voti del 2019 ai meno di novemila del 2024. Il risultato è che il gruppo dei consiglieri della Lega assomma oggi al solo #GuglielmoMossuto, che può orgogliosamente fregiarsi del titolo di capogruppo di se stesso.

Interessante... per i fans...

rollingstone.it/musica/news-mu…

I Genesis pubblicheranno una versione espansa di ‘The Lamb Lies Down on Broadway’

L’occasione è il mezzo secolo dell’album del 1974, l’ultimo con Peter Gabriel, ma la riedizione uscirà nel 2025. Conterrà tra le altre cose demo inediti e un concerto allo Shrine Auditorium di Los Angeles

^{Rolling Stone It (Rolling Stone Italia)}