Discovering that an external element has “hijacked” your information and demands payment to release it is extremely worrying, but when that element acquires a certain “professional” touch, everything becomes even more outrageous. That is exactly what has happened with CryptoWall 2.0, something like the “heir” to CryptoLocker. Thanks to a recent analysis by the folks at Cisco, it has been concluded that CryptoWall 2.0 is not the work of amateurs.
A Professional Approach to Ransomware
When you see CryptoWall 2.0 in action, you are surprised even by the words the developer chose in the message: your files have not been “hijacked”, but “protected”. It explains that the structure of the files has “changed irrevocably”, and that the victim “should not waste time” looking for alternative solutions because “they do not exist”. In essence, it invites the user to recognize that they have been defeated, and that the only way to resolve the situation is to make a payment as soon as possible, using one of the Tor addresses that CryptoWall itself provides. This is not the work of a “script kiddie” or someone taking their first steps in malware development. There is precision and determination here, but above all, there is coldness. CryptoWall 2.0 is the most compelling example of professional ransomware in circulation, but some security experts have already crossed swords with its code, and what they found is surprising.
Technical Analysis
Andrea Allievi and Earl Carter from the so-called Talos Group at Cisco revealed several technical aspects of CryptoWall 2.0. First, the malware base has been developed in 32 bits to achieve greater reach; however, it has the ability to detect if the Windows system it is attacking is 64-bit, allowing it to switch to native x64 mode without major issues. In general, the initial module arrives at the computer through a conventional phishing maneuver, then exploiting different Windows vulnerabilities that lead to privilege escalation, but there have also been versions infecting systems through malicious PDF files. All components that are part of the CryptoWall 2.0 installation are encrypted, and as if that were not enough, it has a function to detect the presence of a virtual machine. Its creators are aware that experts use virtual machines to analyze the behavior of malicious code; therefore, CryptoWall verifies that there are no processes linked to VirtualBox, VMWare, or even Sandboxie in memory.
After deactivating all security measures built into Windows and creating a fake svchost.exe process, CryptoWall downloads a Tor client to obfuscate its communications with the command-and-control network. The version investigated by Cisco experts points to domains registered in Russia, and each of those domains resolves to an IP address in that country. Despite the extraordinary level of sophistication, investigations of this kind will make CryptoWall 2.0 reach fewer victims. Another possibility is that antivirus developers may need to incorporate some kind of fake identifier that makes real computers pass as virtual machines.
