SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Linux.Encoder</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Linux.Encoder</span></span>

</h1>

</header>

<p><b>Linux.Encoder</b> (also known as <b>ELF/Filecoder.A</b> and <b>Trojan.Linux.Ransom.A</b>) is considered to be the first <a href="Ransomware" title="Ransomware">ransomware</a> <a href="Trojan_horse_(computing)" title="Trojan horse (computing)">Trojan</a> targeting computers running <a href="Linux" title="Linux">Linux</a>.<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> There are additional variants of this Trojan that target other Unix and Unix-like systems. Discovered on November 5, 2015, by <a href="Dr._Web" class="mw-redirect" title="Dr. Web">Dr. Web</a>, this malware affected at least tens of Linux users.<sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p><p>Linux.Encoder.1 is remotely executed on the victim's computer by using a flaw in <a href="Magento" title="Magento">Magento</a>, a popular <a href="Content_management_system" title="Content management system">Content management system</a> app. When activated, the malware encrypts certain types of files stored on mounted local and network drives using <a href="Advanced_Encryption_Standard" title="Advanced Encryption Standard">AES</a> and <a href="RSA_(cryptosystem)" class="mw-redirect" title="RSA (cryptosystem)">RSA</a> <a href="Public-key_cryptography" title="Public-key cryptography">Public-key cryptography</a>, with the private key stored only on the malware's control servers. The malware then store a file called "readme_to_decrypt.txt" in every directory, containing a message, which offers to decrypt the data if a payment (through <a href="Bitcoin" title="Bitcoin">Bitcoin</a>) is made.<sup id="cite_ref-:0_3-0" class="reference"><a href="#cite_note-:0-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup> Compared to other ransomware such as <a href="CryptoLocker" title="CryptoLocker">CryptoLocker</a>, the malware does not state a deadline to pay and the ransom does not increase over time.

</p>

<div class="mw-heading mw-heading2"><h2 id="Discovery">Discovery</h2></div>

<p>On November 5, 2015, <a href="Dr._Web" class="mw-redirect" title="Dr. Web">Dr. Web</a>, a Russian anti-malware company added to its virus database Linux.Encoder.1. The company then published the malware description the day after. This ransomware is written in C using the <a href="Mbed_TLS" title="Mbed TLS">PolarSSL</a> library.<sup id="cite_ref-:1_4-0" class="reference"><a href="#cite_note-:1-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Operation">Operation</h2></div>

<div class="mw-heading mw-heading3"><h3 id="Propagation">Propagation</h3></div>

<p>According to <a href="Bitdefender" title="Bitdefender">Bitdefender</a> Labs, the most common infection vector is through a flaw in <a href="Magento" title="Magento">Magento</a>, a shopping cart software. <a href="Check_Point" title="Check Point">CheckPoint</a>, reported this vulnerability in April 2015.<sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup> After this report, Magento issued a fix. However, a lot of small e-commerce sites did not apply this critical update.<sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup> Linux host might also be attacked using other exploits.

</p>

<div class="mw-heading mw-heading3"><h3 id="File_encryption">File encryption</h3></div>

<div class="mw-heading mw-heading4"><h4 id="Encrypted_files">Encrypted files</h4></div>

<p>When run as root, the program loads two files into memory containing the attackers' demands:

</p>

<ul><li>./readme.crypto</li>

<li>./index.crypto</li></ul>

<p>After this the ransomware receives the public RSA key. The malware will then start as a daemon and delete all its original files. The trojan will encrypt files with the extensions : ".php", ".html", ".tar", ".gz", ".sql", ".js", ".css", ".txt" ".pdf", ".tgz", ".war", ".jar", ".java", ".class", ".ruby", ".rar" ".zip", ".db", ".7z", ".doc", ".pdf", ".xls", ".properties", ".xml" ".jpg", ".jpeg", ".png", ".gif", ".mov", ".avi", ".wmv", ".mp3" ".mp4", ".wma", ".aac", ".wav", ".pem", ".pub", ".docx", ".apk" ".exe", ".dll", ".tpl", ".psd", ".asp", ".phtml", ".aspx", ".csv".

</p><p>The malicious program encrypts files with the aforementioned extensions in the following directories:

</p>

<li>/var/lib/mysql</li>

<li>/etc/nginx</li>

<li>/etc/apache2</li>

<p>After this, the malware will encrypt all the files from directories with a name starting by:

</p>

<ul><li>public_html</li>

<li>webapp</li>

<li>backup</li>

<p>The program will <b>not</b> encrypt files in the following directories

</p>

<p>The program will then generate a file called "readme_for_decryption.txt" in every folder. This file contains the Bitcoin address generated specifically for the ransom and the website to download the decrypting tool hosted on a .<a href="Tor_onion" class="mw-redirect" title="Tor onion">onion</a> website.

</p>

<div class="mw-heading mw-heading4"><h4 id="Encryption_method">Encryption method</h4></div>

<p>Like other ransomware, Linux.Encoder.1 use mixed-encryption algorithms to encrypt data. It starts by generating an AES key on the victim's device and encrypts all of the previous files using <a href="Advanced_Encryption_Standard" title="Advanced Encryption Standard">AES</a>-<a href="Cipher-block_chaining" class="mw-redirect" title="Cipher-block chaining">CBC</a>-128. Then the <a href="RSA_(cryptosystem)" class="mw-redirect" title="RSA (cryptosystem)">RSA</a>-encrypted AES key is prepended to the beginning of every encrypted file, with the original file permissions and the <a href="Initialization_vector" title="Initialization vector">IV</a> used by the AES algorithm. All the encrypted files have ".encrypted" added at the end of their file name.<sup id="cite_ref-:0_3-1" class="reference"><a href="#cite_note-:0-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup>

</p><p>The program use the libc <a href="Rand()" class="mw-redirect" title="Rand()">rand()</a> function with the timestamp at the moment of encryption as seed to generate the IV and the keys.

</p>

<div class="mw-heading mw-heading3"><h3 id="Decryption">Decryption</h3></div>

<p>When the payment to the cybercriminal is made, the victim can download a PHP script to their computer. This script will use the RSA private key to recover the symmetric AES key and decrypt all the files with the ".encrypted" extension. Along with the file decryption, the decryption tool will also delete every "readme_for_decryption.txt" file on the hard drive.

</p>

<div class="mw-heading mw-heading2"><h2 id="Recovering_files">Recovering files</h2></div>

<p>Because of the use of the <a href="Timestamp#Digital_timestamps" title="Timestamp">timestamp</a> as a <a href="Random_seed" title="Random seed">seed</a> for creating the <a href="Key_(cryptography)" title="Key (cryptography)">keys</a> and the <a href="Initialization_vector" title="Initialization vector">IV</a> for encryption, decryption of files encrypted by the ransomware is trivial given that the original timestamp information is kept intact. Researchers at Bitdefender Labs have found and exploited this weakness to recover the files without having to pay the criminals.<sup id="cite_ref-:0_3-2" class="reference"><a href="#cite_note-:0-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="On_other_Unix_systems">On other Unix systems</h2></div>

<ul><li>Linux.Encoder.1 has been recompiled on Mac, called <a href="KeRanger" title="KeRanger">KeRanger</a>.</li>

<li>There is a version that infects <a href="FreeBSD" title="FreeBSD">FreeBSD</a>.<sup id="cite_ref-:1_4-1" class="reference"><a href="#cite_note-:1-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .portalbox{padding:0;margin:0.5em 0;display:table;box-sizing:border-box;max-width:175px;list-style:none}.mw-parser-output .portalborder{border:1px solid var(--border-color-base,#a2a9b1);padding:0.1em;background:var(--background-color-neutral-subtle,#f8f9fa)}.mw-parser-output .portalbox-entry{display:table-row;font-size:85%;line-height:110%;height:1.9em;font-style:italic;font-weight:bold}.mw-parser-output .portalbox-image{display:table-cell;padding:0.2em;vertical-align:middle;text-align:center}.mw-parser-output .portalbox-link{display:table-cell;padding:0.2em 0.2em 0.2em 0.3em;vertical-align:middle}@media(min-width:720px){.mw-parser-output .portalleft{margin:0.5em 1em 0.5em 0}.mw-parser-output .portalright{clear:right;float:right;margin:0.5em 0 0.5em 1em}}

/* end https://en.wikipedia.org/ */

</style>

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFBisson2015" class="citation web cs1">Bisson, David (November 10, 2015). <a rel="nofollow" class="external text" href="https://grahamcluley.com/2015/11/website-files-encrypted-linux-encoder-1-ransomware-free-fix/">"Website files encrypted by Linux.Encoder.1 ransomware? There is now a free fix"</a>. <i>Graham Cluley</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2015-11-16</span></span>.</cite></span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://news.drweb.com/show/?i=9686&c=5&lng=en&p=0">"Encryption ransomware threatens Linux users"</a>. <i>Dr. Web</i>. November 6, 2015<span class="reference-accessdate">. Retrieved <span class="nowrap">2015-11-16</span></span>.</cite></span>

</li>

<li id="cite_note-:0-3"><span class="mw-cite-backlink">^ <a href="#cite_ref-:0_3-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-:0_3-1"><sup><i><b>b</b></i></sup></a> <a href="#cite_ref-:0_3-2"><sup><i><b>c</b></i></sup></a></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/">"Linux Ransomware Debut Fails on Predictable Encryption Key"</a>. <i>Bitdefender Labs</i>. November 10, 2015<span class="reference-accessdate">. Retrieved <span class="nowrap">2015-11-16</span></span>.</cite></span>

</li>

<li id="cite_note-:1-4"><span class="mw-cite-backlink">^ <a href="#cite_ref-:1_4-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-:1_4-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://vms.drweb.com/virus/?i=7704004&lng=en">"Linux.Encoder.1"</a>. <i>Dr. Web</i>. November 5, 2015<span class="reference-accessdate">. Retrieved <span class="nowrap">2015-11-16</span></span>.</cite></span>

</li>

<li id="cite_note-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-5">^</a></b></span> <span class="reference-text"><cite id="CITEREFRubin2015" class="citation web cs1">Rubin, Netanel (April 20, 2015). <a rel="nofollow" class="external text" href="http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/">"Analyzing the Magento Vulnerability"</a>. <i>Check Point Blog</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2015-11-16</span></span>.</cite></span>

</li>

<li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://krebsonsecurity.com/2015/11/ransomware-now-gunning-for-your-web-sites/">"Ransomware Now Gunning for Your Web Sites"</a>. <i>Krebs on Security</i>. November 15, 2015<span class="reference-accessdate">. Retrieved <span class="nowrap">2015-11-16</span></span>.</cite></span>

</li>

</ol></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-01-09" href="https://en.wikipedia.org/wiki/?title=Linux.Encoder&oldid=1268468444">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>