There has been a Ransomware explosion the last 6 years and there have been very little done to stop infections aside from deprecated signature scans and classic malware scanner. Weston will go over a couple proof of concepts that work on even the most current versions of the malware stop from fully infecting the machines that would otherwise be infected with malware that demands 1000s of dollars in some instances. Weston will go over several methods of making your system immune to attacks from ransomware many of them were discovered from actually reverse engineering the malware early this year. Weston will also go over several open source tools to test your environments impact from malware such as Cryptowall and several tools both software and hardware that can protect your systems from malware infecting even methods of abusing the payment gateway system to allow you to get more than one file unlocked for free and Weston will also go into the research about breaking the encryption based on the outputted encrypted files.

1. Senior Security Consultant/Senior Pentester
TWITTER, LinkedIN @westonhecker
Rapid7 www.Rapid7.com
Weston Hecker

2. “A little bit about myself and Rapid7”
 Senior Security Engineer/Senior Pentester/ Security
Researcher.
 Over 11 years Pentesting, Speaker at Defcon 22,23
and 24 Las Vegas, HOPE 11, TakedownCON 2016,B-
sides Boston, Blackhat 2016, Enterprise Connect 2016,
ISC2, SC Congress Toronto.
 12 years programming and Reverse Engineering.
 Side projects Department of Home Land Security.
Attacking 911 centers / Malware analysis Ransomware.
Hacking ATM’s, Cars, Point of Sale Systems, Hotel Key
Systems - Property Management Software.

3. • Funded all my research this year by unbricking
• 100s of 3tb Hard Drives

7. “Ransomware: How to Make Your Systems
Immune to Modern Malware/Ransomware”
• What is this talk about?
 Tools used .
 A brief History of Malware and Ransomware.
 How I came across the malware.
 How it was pulled apart/ A look at payloads and evasion
methods
 How to defend your systems from:
 Droppers.
 Main Payloads.
 In effect making you computers immune to most
modern malware

8. Special environment “Tackled Virtual Machine”
VMWare, Windows 7, IDA Pro, Unpackers,
Injectors

9. “Tested on Over 26 Different Variants ”
• Tested on Which Ransomware?
 SAMSAM, Custom Variants. 2016
 Cryptolocker 1-3. 2015-2016
 Cryptowall 1-4. 2014-2016
 Locky 1-2. 2016
 Malware Had to Evolve cause of ..

10. Ransomware Had to
Evolve

11. NextGen Security Devices

13. New Years 2016

14. “I get excited when people send me malware”
• How did I get my first sample of it ?
 An acquaintance that I meet at Defcon 18 sends me
malware all the time.
 He runs a self destructing mail service on TOR as a
honeypot project.
 He comes across a lot of custom tailored malware.
 He sold me a few samples on New Years 2016 for 1
billion ISK which is a “EVE online” currency
 I recently got some very cool custom tailored ICS
oilfield specific malware. I will be wringing a white
paper on it this October and I have call for papers in at
ICS security convention first of its kind to attack MWD
and oil productions to my knowledge.

15. Toolkits

16. What is A Dropper

17. “A Look at Payloads”
• The End Goal of Malware. What it does

18. “A Look at Payloads”
• What does the Ransomware look for >?

19. Some of the Malware uses advanced Methods to
stop reverse engineering even ones used by
software companies

20. Attacking the Dropper.

21. Virus Detection cant keep up with packed droppers
Signatures “Heuristics Engine” Method of protection
fails you

22. Old Yeller.exe
Software Method 1

23. Why This Works ?

24. Anti-Virus Watchdog.

25. Change in registry.

26. Old Yeller.

27. Intentional Blue Screen.

28. Keetz.exe
Software Method 2

30. EMO.exe
Emulates sandbox flags that
Malware and droppers are
looking for.
Software Method 3

31. EMO-Tool Sand Box Emulator

32. Works on most variants of Cryptowall 1, 2, 3 and 4
Cryptolocker and “Sams Choice” Variants that use
7zip or other software to do dirty work.
Hardware Method 1

33. Market flooded with Bad USB’s.

34. This takes advantage of the
Parse Order of the Ransomware.

35. Hacked USB Method

36. “A Drive Filled with data keeps malware busy”
• Remember What does the Ransomware look for >?

37. Intentional Blue Screen.

38. Works on most variants of Cryptowall 1, 2, 3 and 4
Cryptolocker and “Sams Choice” Variants that use
7zip or other software to do dirty work.
Hardware Method 2

39. Teensy Honeypot USB Method
• Teensy 3.1 or 3.2
• Mounts as USB Drive partition
• Change Partition to A:// Drive
• Fill with files Load Payload
• Once partition is touched switches to HID k
eyboard shuts machine down
• Make sure you exclude from your AV
• Hard shutdown “Shutdown –h now”
• Thanks to the guy at Bsides Boston for the
Idea
• Code coming October I’ll update on Twitter

40. You can do graceful shutdown
or …..

41. You Can Do Graceful Shutdown or the Hardway

42. EMO.exe
Crypto-Locker Simulator
Back to Software

43. “Hiding Your Files”
• Can also hide files or backup in systems folders.
• Delete backups and shadow copies. Using shift
disk utility function of EMO-Tool
• No Ransomware I came across does DOD or Low
level format.
• Morphing your file system.
• Email plugin strips all macro for that user.
• Switches to internal trusted file extension for that
file.

45. “Testing Frame work Now With Unlock Feature”
• Here is list of tools functions
 Testing of POST call home.
 Search for open WR shares.
 Test your backups against encryption.
 Calculate ransomware amount.
 Build a master unlock file off of Bait file.
 Check Different account levels access to parts of your
domain.
 Report for Pentest reports.
 Control Keetz.exe and Oldyeller.exe Emo.exe functions.
 Pull Systems files at time of infection.
 Downgrade clock on encrypted files if backup is available.
 Testing Payload avoidance

46. “Version 2.0
of Testing
Tool with
unlock
capabilities”

47. “Testing How systems would be
affected by Bitlocker”

48. A look at Beta EMO-Tool

49. Outlook Plugin

50. Other ways to protect your data

51. Senior Security Consultant/Senior Pentester
TWITTER @westonhecker
Rapid7
Weston Hecker