K7 Antivirus

  BleachGap ransomware was first reported in Feb 2021 by a researcher named   Petrovic   on Twitter. This   ransomware variant  that we have analysed was reported on   Twitter   in June 2022. This variant got us curious to get into the nuances of it because it was tagged as a   stealer and all the code was compiled in a single executable thereby not needing any supporting .bat or PowerShell scripts to execute , most probably done for evasion and to be less noisy in comparison to the variant found  in 2021, which needed the supporting .bat and .exe that it dropped for execution.Though there are not many cases reported in the wild, this blog has been written   to let the cyber community know that threat actors are modifying the attack techniques of this malware for a possible major attack that might be planned in the future.  Lets now get into the details. Why a Stealer? When this ransomware executes, the first step is to get the user...

  In this internet era, we consume Giga Bytes (GBs) of data everyday, which includes surfing the internet, streaming videos, online games, or using social media such as Facebook, Instagram, LinkedIn etc. Some of the websites provide access based on user authentication, such as a login page, to restrict public access and monitor user activity and bandwidth. To access websites requiring user authentication, a user needs to create an account with username and password. After entering the credentials, the backend web server authenticates the user login and provides the access to the user which is nothing but HTTP authentication, often abused by threat actors for their malicious activity. HTTPS authentication is the recommended method and it is being used widely now-a-days but still we are witnessing HTTP authentication which is not recommended. In this blog, we will see both valid & invalid HTTP authentications and focus on how HTTP authentication is abused by threat actors for the...

  We at K7 Labs came across DcDcrypt ransomware sample, that had infected a user machine and encrypted all user files. Usually the chances of getting back the encrypted files in such a scenario is 0, given the level of sophistication involved in the encryption. Also paying up the ransomware does not guarantee the files be decrypted as “promised” in the ransomware note. Usually the ransom notes and the encrypted are only left behind in a victimized system, the ransomware sample usually gets self-deleted. This case wasn’t so, the ransomware binary was available and naturally we had a closer look at it. Turns out we were able to decrypt the user files after having looked at the malware. The malware and the decryptor would be henceforth discussed. Analysing Ransomware This is a basic ransomware written in C#. It encrypts the user files and writes a ransom note in every directory. It does not delete backups, does not create persistence,does not even self-delete(like we mentioned earlier...