<jupyter_start><jupyter_text>BlackCat Ransomware> Analysis of new BlackCat ransomware  with encrypted config- toc: true - badges: true- categories: [blackcat,ransomware,malware,python,dumpulator,emulation] > twitter: https://twitter.com/pancak3lullz/status/1504208693277212674  OverviewSample `<KEY>`**References**- Sample is on [MalwareBazaar](https://bazaar.abuse.ch/sample/6dd995d896a9a593b2c48d09da60bd83866d8577273f36d38788d83ad8173e68/)- Old config extracto from f0wl on [blackCatConf](https://github.com/f0wl/blackCatConf) - Paloalto [Threat Assessment: BlackCat Ransomware](https://unit42.paloaltonetworks.com/blackcat-ransomware/)- Talos [From BlackMatter to BlackCat: Analyzing two attacks from one affiliate](https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html) Rust Reverse EngineeringBlackCat is written in Rust and is very time consuming to reverse engineer. To speed up the process we used a combination of debugging and some python scripts courtesy of @fwosar. The ConfigThere is a new BlackCat ransomware sample out and it the config is now protected using a command line supplied ACCCESS_TOKEN. The token is used to generate an AES key which is then used to decrypt the encrypted config.  Notes**Ransomware options**```USAGE:     [OPTIONS] [SUBCOMMAND]OPTIONS:        --access-token                Access Token        --bypass ...        --child                                     Run as child process        --drag-and-drop                             Invoked with drag and drop        --drop-drag-and-drop-target                 Drop drag and drop target batch file        --extra-verbose                             Log more to console    -h, --help                                      Print help information        --log-file                        Enable logging to specified file        --no-net                                    Do not discover network shares on Windows        --no-prop                                   Do not self propagate(worm) on Windows        --no-prop-servers ...      Do not propagate to defined servers        --no-vm-kill                                Do not stop VMs on ESXi        --no-vm-kill-names ...    Do not stop defined VMs on ESXi        --no-vm-snapshot-kill                       Do not wipe VMs snapshots on ESXi        --no-wall                                   Do not update desktop wallpaper on Windows    -p, --paths ...                          Only process files inside defined paths        --propagated                                Run as propagated process        --ui                                        Show user interface    -v, --verbose                                   Log to console```**Set desktop ransom note**`\\All Usersdeploy_note_and_image_for_all_users=`**Mutex**`Local\\RustBacktraceMutex`**Batch file name**`drag-and-drop-target.bat`**Batch file contents (encrypted)**```@ECHO OFFSETLOCALSET allargs=%*"${EXECUTABLE}" --access-token ${ACCESS_TOKEN} --drag-and-drop -p %allargs%``` Propogation  The ransomware contains an embedded encrypted copy of [psExec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec). This is likely used as part of their propagation (worm). The ransomware can be executed via the `drag-and-drop-target.bat` batch files. These are a useful artifact to recover during IR as they will contain the ACCESS_TOKEN which can be used to decrypt the config.   Entropy FiderTo help identify high entropy sections of the binary (encrypted data) we used this nice script from @fwosar<jupyter_code># Entropy find script by @fwosar

def report_entropies(file_path):
    import rolling
    from pathlib import Path
    data = Path(file_path).read_bytes()
 
    entropies = rolling.Entropy(data, 512)
    high_entropy_start = None
    for i, entropy in enumerate(entropies):
        if entropy > 7 and not high_entropy_start:
            high_entropy_start = i + 512
        if entropy < 7 and high_entropy_start:
            print(f"Found high entropy section starting at {hex(high_entropy_start)} up to {hex(i + 512)}. Totalling {(i + 512) - high_entropy_start} bytes.")
            high_entropy_start = None
    if high_entropy_start:
        print(f"Found high entropy section starting at {hex(high_entropy_start)} up to {hex(len(data))}. Totalling {len(data) - high_entropy_start} bytes.")<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.08215426745778183, 'fraction_numerical': 0.020310360565951622, 'mean_word_length': 2.42421875, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 9, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 13, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '1', 'dir': 'jupyter-structured-clean-dedup', 'id': '462657', 'license': 'Apache-2.0', 'n_tokens_mistral': 1257, 'n_tokens_neox': 1146, 'n_words': 399, 'path': '_notebooks/2022-03-16-blackcat_ransomware.ipynb', 'repo_name': 'OALabs/research', 'size': '4441'}