CryptoWall 4.0 Released with a New Look and Several New Features
The fourth member of the CryptoWall family of ransomware, CryptoWall 4.0, has just been released, complete with new features and a brand new look.
We recently reported that CryptoWall 3.0 has allegedly caused over $325 million in annual damages. CryptoWall first emerged in April 2014. Its first major upgrade was dubbed CryptoWall 2.0, and first emerged in October 2014. CryptoWall 3.0 then emerged in January 2015 and terrorized organizations on a global scale. Now, in November 2015, CryptoWall 4.0 has emerged.

New Features
New features such as the encryption of the names and extensions of affected files have emerged with the 4th member of the CryptoWall family. Additionally, CryptoWall 4.0 has changed the name of its ransom notes to HELP_YOUR_FILES.TXT and HELP_YOUR_FILES.HTML. The ransom note itself contains payment instructions, and also mocks the infected user.


Spread Method
The initially reported sample, provided by an infected user on the Bleeping Computer forums, was spread via e-mail through phishing e-mails with ZIP archive attachments claiming to be resumes. The file within the ZIP archive is a JavaScript file, that is obfuscated and beautified that downloads the CryptoWall 4.0 payload from a hard-coded URL.

Note: The below is the slightly deobfuscated, beautified version of the JS file. The fully obfuscated version can be provided at the viewers’ request.

However, it’s likely that exploit kits will begin to deliver CW4 as a payload very soon, if they are not already (especially the Angler EK).


Technical Information

The C&C communication and behavioural activity of CryptoWall 4.0’s payload is quite similar to its earlier versions. The specific sample that I have analyzed performed the following actions, as can be evidenced by the below images.

Contacted Domains

Added Files

Deleted Files

Modified Files

Added Registry Keys

Process Tree

  • INITIAL SAMPLE
    • explorer.exe
      • svchost.exe -k netsvcs
        • NOTEPAD.EXE “C:UsersAdministratorDesktopHELP_YOUR_FILES.TXT”
        • firefox.exe “C:UsersAdministratorDesktopHELP_YOUR_FILES.HTML”
      • vssadmin.exe Delete Shadows /All /Quiet
Contact CipherTechs

Your Name (required)

Your Email (required)

Subject

Your Message

×
Join our team!

Your Name (required)

Your Email (required)

Subject

Your Message

Upload Resume

×
Contact CipherTechs

Your Name (required)

Your Email (required)

Subject

Your Message

×
Share This