Magniber Ransomware

Magniber Ransomware Wants to Infect Only the Right People

Exploit kit (EK) utilize has been on the decay since late 2016; in any case, certain action stays steady. The Magnitude Exploit Kit is one such case that keeps on influencing clients, especially in the APAC locale.

In Figure 1, which depends on FireEye Dynamic danger Intelligence (DTI) reports partook in March 2017, we can see the locales influenced by Magnitude EK action amid the most recent three months of 2016 and the initial three months of 2017.

This pattern proceeded until late September 2017, when we saw Magnitude EK concentrate basically on the APAC district, with an extensive lump focusing on South Korea. Extent EK action at that point tumbled off the radar until Oct. 15, 2017, when it returned and started concentrating exclusively on South Korea. Already it had been conveying Cerber ransomware, however Cerber circulation has declined (we have additionally observed a decrease of Cerber being appropriated by means of email) and now it is dispersing ransomware known as Magniber.

Infection

The main return of Magnitude EK on Oct. 15 came as a malvertising redirection from the area: fastprofit[.]loan. The contamination chain is appeared in the following figure.

Infection chain

The Magnitude EK presentation page comprised of CVE-2016-0189, which was first revealed by FireEye as being utilized as a part of Neutrino Exploit Kit after it was fixed. Figure 3 demonstrates the point of arrival and CVE use.

Magnitude EK landing page

As observed beforehand with Magnitude EK, the payload is downloaded as a plain EXE (see following figure) and space foundation is facilitated on the accompanying server: 

"Apache/2.2.15 (CentOS) DAV/2 mod_fastcgi/2.4.6"

 Magnitude payload header and plain MZ response

Payload

In the underlying report distributed by our partners at Trend Micro, the ransomware being appropriated is alluded to as Magniber. These ransomware payloads just appear to target Korean frameworks, since they won't execute if the framework dialect isn't Korean.

Magniber scrambles client information utilizing the AES128. The specimen utilized (dc2a2b84da359881b9df1ec31d03c715) for this examination was pulled from our DTI framework when the crusade was dynamic. Of note, this specimen varies from the hash shared publically by Trend Micro, however the two display a similar conduct and offer the disease vector, and both were appropriated around a similar time.

The malware contains a twofold payload in its asset segment encoded backward utilizing RC4. It begins unloading it from the finish of the cushion to its begin. Turn around RC4 decoding keys are 30 bytes in length and furthermore contain non-ASCII characters. They are as per the following:

dc2a2b84da359881b9df1ec31d03c715 RC4 key:

{ 0x6b, 0xfe, 0xc4, 0x23, 0xac, 0x50, 0xd7, 0x91, 0xac, 0x06, 0xb0, 0xa6, 0x65, 0x89, 0x6a, 0xcc, 0x05, 0xba, 0xd7, 0x83, 0x04, 0x90, 0x2a, 0x93, 0x8d, 0x2d, 0x5c, 0xc7, 0xf7, 0x3f }