Key Points

• CryptNet is a new ransomware-as-a-service that has been advertised in underground forums since at least April 2023
• The CryptNet threat group claims to perform double extortion attacks by combining data exfiltration with file encryption
• The ransomware code is written in the .NET programming language
• CryptNet uses 256-bit AES in CBC mode and 2048-bit RSA to encrypt files
• The CryptNet ransomware codebase is closely related to Chaos ransomware

 

Zscaler ThreatLabz has been tracking a new ransomware group known as CryptNet that emerged in April 2023. The group claims to exfiltrate data prior to performing file encryption and hosts a data leak site hosted on a Tor hidden service that currently contains two victims. The group operating the ransomware is also actively recruiting affiliates on criminal forums to conduct breaches. The CryptNet ransomware code is written in .NET and obfuscated using .NET Reactor. After removing the obfuscation layer, CryptNet shares many resemblances to the Chaos ransomware families and the latest variant that is known as Yashma. The code similarities include the encryption methods, capabilities to disable backup services and delete shadow copies. CryptNet appears to have streamlined the Yashma code to improve the file encryption performance.

In this blog, we will analyze the features of CryptNet and the close relationship with Yashma ransomware.

 

Technical Analysis

Obfuscation

The CryptNet sample analyzed by ThreatLabz was obfuscated using Eziriz's .NET Reactor. The tool NetReactorSlayer is easily able to remove the control flow and symbols obfuscation layers, but the ransomware’s important strings remain obfuscated in a resource section, which is encrypted using a custom algorithm as shown in Figure 1.

Figure 1. Example CryptNet string decryption algorithm

 

ThreatLabz has reimplemented this custom encryption algorithm in Python here. 

After decryption, the strings are stored sequentially with each string preceded by a DWORD value (in little endian) representing its size (in red) as shown in Figure 2.

Figure 2. Decrypted .NET Reactor strings data structure

 

CryptNet then accesses each string by an offset into this structure.

 

Decryption ID

One of the first actions taken by the ransomware is to generate a decryption ID that will be added to the ransom note as shown in Figure 3.

Figure 3. CryptNet decryption ID generation

 

The decryption ID is composed of two hardcoded characters followed by 28 pseudorandom characters followed by two more hardcoded characters. Therefore, every encrypted system will have a unique decryption ID, although the victim can be determined by the hardcoded prefix and suffix characters.

 

File Encryption

After the victim ID is generated, the ransomware will start the main encryption routine as shown in Figure 4.

Figure 4. Main CryptNet encryption routine

 

CryptNet will first loop through all directories for each drive letter, excluding those shown in Table 1.

 

Table 1. Directories excluded by CryptNet from file encryption

 

The following file names in Table 2 are also excluded from file encryption.

 

Table 2. File names excluded by CryptNet from file encryption 

 

CryptNet will encrypt all files that match the following extensions in Table 3.

 

Table 3. File extensions encrypted by CryptNet

Depending on the file size, the ransomware will encrypt parts of the file or the full file content. If the file is less than 512KB in size, CryptNet will encrypt the full file. Otherwise, the code will encrypt just the first 128KB of data from the beginning, middle and end of the file as shown in Figure 5.

Figure 5. CryptNet encryption algorithm for large files 

 

The symmetric encryption algorithm used in both cases is AES in CBC mode with a pseudo randomly generated 32-byte key and 16-byte initialization vector (IV) per file. Each file’s AES key will be encrypted with a hardcoded 2,048-bit RSA key. The ransomware stores the RSA key as an encrypted string in XML format with the RSA modulus and exponent base64 encoded as shown below:

<RSAKeyValue><Modulus>8TO8tQQRyFqQ0VShtSpLkDqtDVsrxS8SfdOsqRAj8mWF7sVoGzyZMcv501DF6iZUdKYsFDlaSMnuckG9+MJmD2ldZwU/0H6Xztkta1BkJWSO2qHg2JAGDp9ZsFGP1wDR9oRb1w7wtBe7Db3wf7q848+qKPWiTP/2R/jlR4evW73M65Jdo9uOzQnbmvw+blsloXeszuYlW2nCcwQ7WarzAK29UmM9ZHS0/lqzU0KHNU+DvyfGwmMJgtb2HN6GFGXq9Z0n3dNBCQVzdUl2G/7fLAMoFbJeExn5USZdFHr2ygheTilo/shmfq7tcPCZM8C4zqBtb0Nbct0f/M48+H920Q==</Modulus><Exponent>AQAB</Exponent></RSAKeyValue>

The RSA encrypted AES key is then prepended to the encrypted file content. 

 

Ransom note and finishing actions

During the encryption process, CryptNet will drop a ransom note with the name RESTORE-FILES-[9 random chars].txt containing the following text:

 

*** CRYPTNET RANSOMWARE ***

--- What happened? ---

All of your files are encrypted and stolen. Stolen data will be published soon
on our tor website. There is no way to recover your data and prevent data leakage without us
Decryption is not possible without private key. Don't waste your and our time to recover your files. 
It is impossible without our help

--- How to recover files & prevent leakage? ---

To make sure that we REALLY CAN recover your data - we offer FREE DECRYPTION for warranty. 
We promise that you can recover all your files safely and prevent data leakage. We can do it!

--- Contact Us---

Download Tor Browser - https://www.torproject.org/download/ and install it
Open website:  http://cryptr3fmuv4di5uiczofjuypopr63x2gltlsvhur2ump4ebru2xd3yd.onion
Enter DECRYPTION ID:  [DECRYPTION ID]

 

CryptNet will then proceed to change the wallpaper and kill the following processes in Table 4.

 

Table 4. Processes terminated by CryptNet

 

Additionally, if the ransomware is run with administrator privileges, CryptNet will stop the list of services shown in Table 5.
 

 

CryptNet will also remove Windows shadow copies and then delete the backup catalog if the ransomware has administrator privileges. To perform those actions, the following commands are executed:

vssadmin delete shadows /all /quiet & wmic shadowcopy delete
bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
wbadmin delete catalog -quiet

 

Victim Portal and Data Leak Site

When a victim accesses the Tor hidden service in the ransom note, a login screen prompts the user to enter a decryption ID and solve a captcha as shown in Figure 6.

 

Figure 6. CryptNet victim ransom portal

 

After the decryption ID is entered, the victim is presented with a timer and an option to test file decryption as shown in Figure 7.