Hexalocker-v2-being-proliferated-by-Skuld-Stealer

Key Takeaways

• HexaLocker was first found in mid-2024, with model 2 introducing important updates and enhanced functionalities.
• HexaLocker V2 features a persistence mechanism that modifies registry keys to make sure continued execution after the affected system reboots.
• The up to date model downloads Skuld Stealer, which extracts delicate data from the sufferer’s system earlier than encryption.
• Not like its predecessor, HexaLocker V2 exfiltrates sufferer recordsdata earlier than encrypting them, following the double extortion technique of information theft and file encryption.
• HexaLocker V2 makes use of a mix of superior encryption algorithms, together with AES-GCM for string encryption, Argon2 for key derivation, and ChaCha20 for file encryption.
• HexaLocker V2 replaces the TOXID communication technique with a singular hash, enabling victims to speak with the Risk Actors’ (TA’s) website. 

Govt Abstract

On August ninth, the HexaLocker ransomware group introduced a brand new Home windows-based ransomware on their Telegram channel. The put up highlighted that the ransomware was developed within the Go programming language and claimed that their workforce included members from notable teams like LAPSUS$ and others. Following this announcement, researchers from Synacktiv analyzed this ransomware variant and revealed their findings shortly after.

On October twenty first, cybersecurity researcher PJ04857920 shared a put up on X, revealing that the admin behind HexaLocker had determined to close down the operation and put the ransomware’s supply code and net panel up on the market based mostly on data from the HexaLocker group’s Telegram channel.

Later, on December twelfth, they supplied one other replace on X, stating that the HexaLocker ransomware had been revived, with indicators of ongoing growth and exercise. The Telegram put up additionally talked about that the upgraded model of HexaLocker would characteristic enhanced encryption algorithms, stronger encryption passwords, and new persistence mechanisms.

Cyble Analysis and Intelligence Labs (CRIL) got here throughout a brand new model of the HexaLocker ransomware. Upon execution, it copies itself to the %appdata% listing, creates a run entry for persistence, encrypts recordsdata, and appends the “HexaLockerv2” extension to them.

Previous to encryption, the ransomware additionally steals the sufferer’s recordsdata and exfiltrates them to a distant server. Notably, on this new model, the ransomware downloads an open-source stealer named Skuld to gather delicate data from the sufferer’s machine earlier than encryption. The determine beneath exhibits the Hexalocker Ransomware Website used for Sufferer’s communication.

Technical Particulars

Persistence

Upon execution, the HexaLocker ransomware creates a self-copy named “myapp.exe” within the “%appdatapercentMyApp” listing and establishes persistence by including an AutoRun entry at “HKCUSoftwareMicrosoftWindowsCurrentVersionRun” with the worth “MyAppAutostart” guaranteeing the ransomware binary executes upon system reboot.

Obfuscation

All string references, together with the Stealer URL, file paths, folder names, atmosphere variable names, WMIC instructions, and ransom notes, are generated throughout runtime via a number of layers of AES-GCM decryption. This method successfully obfuscates the strings, making them tougher to detect by safety options. In distinction, all strings within the earlier model have been statically seen.

Stealer

Previous to initiating the encryption course of, the ransomware downloads a stealer binary, a Go-compiled program, from the URL hxxps[:]//hexalocker.xyz/SGDYSRE67T43TVD6E5RD[.]exe and executes it from the present listing. This stealer performance was absent within the earlier model of HexaLocker.

The downloaded stealer, recognized as Skuld, is an open-source software designed to focus on Home windows methods and steal consumer knowledge from numerous functions akin to Discord, browsers, crypto wallets, and extra.

On this case, the TA has utilized solely the browser module from the various obtainable within the open-source Skuld Stealer. The picture beneath exhibits perform names corresponding solely to the browser module from the Skuld undertaking.

The stealer collects numerous delicate knowledge saved by Chromium and Gecko-based browsers, akin to cookies, saved bank card data, downloads, searching historical past, and login credentials. Skuld Stealer targets the next net browsers on this marketing campaign.

Gecko-based browsers

Chromium browsers

The stolen knowledge is compressed right into a ZIP archive named ‘BrowsersData-*.zip’ and saved within the AppDataLocalTemp listing earlier than being exfiltrated to the distant server “hxxps://hexalocker[.]xyz/add.php”. The picture beneath exhibits the console output of the stealer upon finishing every stage.

Exfiltration

Upon executing the stealer payload, the ransomware exfiltrates the victims’ recordsdata by scanning all folders ranging from “C:” to seek out recordsdata with extensions matching these listed within the desk beneath. The recognized recordsdata are compiled right into a single ZIP archive named “data_*.zip”, saved within the “%localappdatapercentDataHexaLocker” listing, and subsequently transmitted to the attacker’s distant server by way of “hxxps[:]//hexalocker.xyz/obtain.php”.

Encryption

The ransomware generates a key and the salt wanted for encryption and sends them to a distant server at “hxxps[:]//hexalocker.xyz/index[.]php,” together with host-specific particulars such because the IP tackle, pc identify, and ID. This data is used to determine the victims and facilitate the restoration of the encrypted recordsdata.

As soon as the gathered data is transmitted to the attacker, HexaLocker proceeds to scan the “C:Customers<username>” listing on the sufferer’s machine. It searches for recordsdata that match a selected set of extensions, as listed within the desk beneath.

The ransomware reads the content material of the unique file and makes use of the ChaCha20 algorithm to encrypt the information. As soon as the encryption is full, it creates a brand new file with the “.HexaLockerV2” extension and writes the encrypted content material to this newly created file. The ransomware then proceeds to delete the unique file utilizing the os.Take away perform, leaving solely the encrypted file behind. The determine beneath exhibits the chacha20 encryption algorithm utilized by the ransomware binary.

The determine beneath illustrates the recordsdata encrypted by the HexaLocker Ransomware, which have the “.HexaLockerV2” extension.

Lastly, the ransomware shows a ransom observe to the sufferer, instructing them to contact the TA via their communication channels, akin to Sign, Telegram, and Net Chat, as proven beneath.

The ransom observe incorporates a singular private hash, which the sufferer makes use of to speak with the TA via a chat window supplied by the attacker, as proven beneath.

Conclusion

The brand new model of HexaLocker ransomware represents a major improve, incorporating enhanced encryption logic and a personalized stealer element. Developed in Go, this ransomware advantages from Go’s effectivity, making it more difficult to detect by endpoints.

Earlier than initiating the encryption course of, the ransomware employs the Skuld stealer to gather delicate data from the sufferer’s machine. This strategic mixture of the Skuld stealer and the ransomware highlights the continual evolution and class of the HexaLocker group, posing an ongoing risk to focused methods.

The Yara rule to detect HexaLocker Model 2 is offered for obtain from the linked Github repository.    

Our Suggestions

Now we have listed some important cybersecurity finest practices that create the primary line of management in opposition to attackers. We advocate that our readers comply with the perfect practices given beneath: 

Security Measures to Forestall Ransomware Assaults 

• Frequently again up necessary recordsdata to offline or cloud storage, guaranteeing they’re saved securely and never linked to the primary community.
• Allow computerized updates in your working system, functions, and safety software program to make sure you obtain the most recent patches and safety fixes.
• Implement endpoint safety with respected anti-virus and anti-malware software program to detect and block potential ransomware threats.
• Educate staff or customers about phishing assaults and suspicious e-mail hyperlinks, that are frequent ransomware supply strategies.
• Limit consumer privileges and keep away from working pointless providers to attenuate the assault floor, guaranteeing customers solely have entry to the sources they want.

MITRE ATT&CK® Methods

Indicators of Compromise (IOCs)

References

https://www.trellix.com/en-in/blogs/analysis/skuld-the-infostealer-that-speaks-golang

https://www.synacktiv.com/publications/lapsus-is-dead-long-live-hexalocker.html

Associated