Researchers: Rishika Desai, Anandeshwar Unnikrishnan

Executive Summary

CloudSEK’s contextual AI digital risk platform XVigil discovered a financially motivated threat actor group, dubbed Eternity, actively operating on the internet, selling worms, stealers, DDoS tools, and ransomware builders.

Timeline of Eternity Ransomware Group

The activities of the original operators of the Eternity ransomware group can be traced back to a couple of years when they were actively operating under different names(Vulturi Stealer, Jester Malware, etc) on multiple forums. However the original threat actor operates on GitHub under the name of ‘L1ghtM4n’, which can be interpreted as ‘LightMan’. The Github repository maintained by this actor, features various projects. Based on the activity of L1ghtM4n, CloudSEK researchers have mapped out the activities leading to the development of the Eternity Malware.

Analysis

The ransomware group Eternity is active on multiple channels and has been providing various updates on all of them, which indicates that the group could be operating as a group. The ransomware builder that the group sold recently, is gaining traction across threat actors. CloudSEK researchers identified a GitHub repository by L1ghtM4n, who is suspected to be one of the operators of Eternity.

Technical Analysis of Eternal Ransomware

Recently, CloudSEK’s Threat Intelligence Research team discovered a sample of Eternity ransomware that encrypts the files and leaves a ransom note.

Pre-Encryption Operations

• The ransomware is written in C#/ .NET, as data initiation proceeds to generate a random password which plays a crucial role in the cryptographic operations. The image below shows the process of password initiation and assignment to a variable “password.”

• The function shown below is responsible for password generation.

• After the successful completion of password generation, the malware executes the function “Encrypt_pass” to securely store it for decryption.

• The Encrypt_pass function is shown below. The password string is encrypted using the RSA cryptographic algorithm. The parameters provided to the algorithm are in the format of aN XML string containing the Modulus and Exponent which are required by the algorithm.

• Interestingly, after the encryption of the password string, the malware encodes the encrypted data using the Base64 encoding scheme. The encoded data is then stored as a “sendme.eternityraas” file in the Desktop directory of the target device. This file is very important as it is required for decryption.
• After the successful encryption of the user data on the system, the malware instructs the user to send the copy of the “sendme.eternityraas” file to attackers via mail along with the ID.
• After paying the ransom demand of USD 800, the attacker sends the password retrieved from the “sendme.eternityraas” file, to the user. The malware then initiates the decryption process.

Encryption Process

• The malware initiates the encryption process by executing the function “start.”
• Both the local and networked drives are enumerated by the malware. In an iterative manner, files in each drive are processed for encryption by executing the function “Attack”, as shown in the image below.

• Each directory is processed as shown in the image below. The malware keeps a very long list of extensions for encryption, and checks to see if the extension of the processed file is in the list or not. If the file passes the check, the malware selects the file for further processing by executing the function “ProcessFile.”

• The files with the following extension will be encrypted by the malware.

• The “ProcessFile” function as shown in the image below, initially checks whether the selected file is marked or not.

• This verification is done by checking the first 3 bytes of the file for the marker “Eth.” If the file is not marked, then the function “ProcessFile” calls another function “EncryptFile” to lock the file.

• When it comes to Directory enumeration, the malware skips files in the following directories:
  • “All Users\Microsoft\”
  • “$Recycle.Bin”
  • “C:\Windows”
  • “C:\Program Files”
  • “Temporary Internet Files”
  • “AppData\”
  • “\source\”
  • “C:\ProgramData”
  • “\Eternity\”
• The following image shows the file encryption function used by the malware. The malware uses the AES cryptographic scheme to lock user data. Prior to writing encrypted data, the malware writes the marker bytes first in the file as shown in the image below. The bytes corresponding to “Eth” are added to the encrypted data as the initial 3 bytes.

Post-Encryption Operations

After encryption, the malware proceeds to execute three functions: “DestroyCopy,” ”SetStartup,” and ”CreateUI.”

DestroyCopy

This function, as the name suggests, destroys the backup copy of the data via WMI. As shown in the following image, the malware accesses WMI “Win32_ShadowCopy” class, and executes the method Delete(). Upon the execution of “Delete,” the backup data is deleted, and the user is prevented from performing a data backup to restore the locked files.

SetStartup

This function writes “Eternity” as a new value in “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run,” which points to the ransomware binary as shown in the image below. This will execute the ransomware each time the user logs into the system.

The image below is the registry snapshot of the Run Key after the execution of the malware sample “sam.exe.”

CreateUI

This function plays a crucial role in the ransomware operation. It initiates and launches a Windows Form as shown in the image below. A Windows Form is the UI element of desktop applications. The malware has a class named PayM3, which represents the Form. The CreateUI function instantiates the required data and executes the Form.

Once the Form is executed, a pop-up is generated as shown in the image below. The decryption logic is linked to this Form. The Form will start the decryption routine when the user submits the right password generated by the ransomware, as mentioned earlier. Since this Form is critical to the decryption of the data, the much sophisticated ransomware hooks the keyboard so that the user doesn’t close the windows, even by accident.

Hooks to Intercept Keyboard Functionality

The aforementioned Form implants a keyboard hook to intercept events on the user’s keyboard in the function PayM3_Load, as shown in the image below. The callback functions “LowLevelKeyboardProc” and “SetWindowsHookEx” are used to hook the user keyboard. And whenever the user presses a key, the system executes the function “captureKey” provided by the malware. Although a keyboard hook is a trivial mechanism in spyware and bots, in this instance, such hooks are used to achieve a different result.

The hook shown in the following image makes certain that the user does not terminate the Form is not explicitly or accidently. The hook is only interested in intercepting Modifier keys such as Shift/ Alt/ CTRL/ Windows keys. Usually, users leverage it to forcefully terminate a program or carry out other tasks like opening the Task Manager on Windows.

The operators of Eternity ransomware use this as a fail-safe feature for the malware by the adversary. The hook simply checks whether the pressed keys are modifier keys. If they are, then it simply executes a return, ensuring that the pressed keys are not registered by the system.

Upon submission of a valid password to the Form, it executes a function called “UndoAttack” that decrypts the locked data.

Recent Incident

• Recently, CloudSEK’s Threat Research Team discovered a sample of Eternity ransomware that encrypts the files and leaves the ransom note.

• To get the decryption key, the victim needs to contact the following communication channels:

• Based on CloudSEK’s investigation, this ransomware is bundled with Eternity Malware.

Links Between L1ghtM4n, Jester, and Eternity

• Based on our technical analysis, the modules developed and posted on the Github repository of L1ghtM4n had been fetched by the Jester malware.
• L1ghtM4n’s details are same as the communication channel provided by the Eternity Team and the technical skills of this threat actor are highly related to malware development.
• All the tutorials and data posted by malware teams associated with L1ghtM4n have been shared in Russian language as well, indicating the origin of the threat actor.
• CloudSEK Researchers believe that there is a slight possibility the recruitment programme for different language speaking trainees during the Virology training was one of the instances from which Eternity could have been formed.
• The advertisements of Eternity, Jester, Lilith, and Merlyn follow a similar an artistic doodle approach which is another observation that helps suggest, mild confidence, a possible connection between them them.

Impact & Mitigation

References

• *https://en.wikipedia.org/wiki/Intelligence_source_and_information_reliability
• ^#https://en.wikipedia.org/wiki/Traffic_Light_Protocol
• Hybrid Analysis

Appendix

Contact Details

Samples & Picture Proofs