With new obfuscation techniques, and attack capabilities, the Hello XD ransomware is now more dangerous than ever before, Unit 42, Palo Alto Networks’ cybersecurity arm, has found.
The group discovered Hello XD now features a new encryptor featuring custom packing, that helps the malware stay hidden. What’s more, it comes with new changes to the encryption algorithm. Instead of the modified HC-128 and Curve25519-Donna, this newly discovered version comes with Rabbit Cipher and Curve25519-Donna. Furthermore, the file marker no longer features a coherent string, but rather carries random bytes, further strengthening the cryptography.
Also, the strain carries a link to an onion site, but according to researchers, the site is currently offline, possibly pending construction.
Deploying MicroBackdoor
Usually, ransomware operators do two things during their attack: exfiltrate all of the sensitive data to a location they can control, and encrypt everything they find on the target network. That way, in case the victim has a backup solution, they can still threaten to release sensitive data online, or sell it to a third party.
Hello XD takes it a step further, it was found, as besides the ransomware, the threat actor also deploys MicroBackdoor, an open-source backdoor that allows remote code execution, file exfiltration, and system modifications.
The malware’s executable is encrypted with WinCrypt API, and embedded within the ransomware payload, it was said. It also doesn’t have a specific amount of money in mind, that it seeks to gain in exchange for the decryption key. Instead, it tells victims to open up a TOX chat service and start a negotiation process.
Hello XD was first spotted late last year, when researchers described it as a spin-off from the then-popular Babuk ransomware. This newly discovered version, however, is a significant step away from Babuk, suggesting that the threat actors behind it plan on developing it further.
To stay safe from cyberattacks, businesses are urged to educate their employees on the dangers of phishing, keep their software up to date, and set up a strong antivirus and firewall solution.
Via: BleepingComputer
