Let's Learn: Deeper Dive into Golang Constructs of Ransomware Called "shifr"

Malware Analysis
1

Goal: Reverse engineer and provide a quick overview of the newer version of the “shifr” ransomware written in Golang.

Not sure what ransomware this is, ID Ransomware didn’t have any ideas either

README.html ransom note
Appends .locked to files

Observed POST to 193.56.28[.]203/ok. Also #opendir that has the ransomware executable in winhosts.rar

cc @demonslay335 pic.twitter.com/4h6FIWjkEp
— FletchSec (@fletchsec) April 9, 2019

Source:
Golang “shift” ransomware
(MD5: 602d2901d55c2720f955503456ac2f68)
Outline:
I. Background & Executive Summary
II. Golang Ransomware “shifr” main* Functions
III. Golang Ransomware: “main_RsaEncrypt” Function  
IV. Yara Signature
V. Appendix
I. Background & Executive Summary
While reviewing the Twitter feed, I noticed an interesting Golang ransomware, discovered by FletchSec.
The original Golang ransomware project contains the following debugging path “C:/Users/sysop/go/src/ransomware/shifr.go” with the “shifr” name.
The ransomware also leverages the following hardcoded Golang libraries for parsing the file user directories:
“C:/Users/sysop/go/src/github.com/kr/fs/filesystem.go”
“C:/Users/sysop/go/src/github.com/kr/fs/walk.go”
Based on the ransomware naming convention, it is possible that the ransomware is related to BleepingComputer’s article titled “New Shifr RaaS Lets Any Dummy Enter the Ransomware Business.”
By and large, the ransomware is not sophisticated but implements RSA and AES cryptography leveraging the Golang crypto prototypes with the hardcoded Base64-encoded public RSA key.
Again, thanks to the Golang IDA code script helpers, developed by George Zaytsev, this code continues to allow deeper reversing of the compiled Go binaries
II. Ransomware “shifr” main* Functions
The Golang version of the malware consists of the following notable main_* named functions and their detailed descriptions:
Golang Function NameDescription
main_RsaEncPrivateKeyconsists of main_RsaEncrypt function and concatenating and returning the key
main_RsaEncryptdecodes the public RSA via Base64 (encoding_base64__ptr_Encoding_DecodeString)  -> crypto_x509_ParsePKIXPublicKey -> crypto_rsa_EncryptPKCS1v15 with crypto_rand_Reader
main_Generateprocesses crypto_rsa_GenerateKey function
main_Stringifyinitliazes crypto_x509_MarshalPKCS1PrivateKey -> RSA PREKEY -> encoding_pem_EncodeToMemory
main_encryptadds “.locked” extension -> crypto_rand_Read -> crypto_sha256_New -> crypto_rsa_EncryptOAEP | crypto_aes_NewCipher -> crypto_cipher_NewCFBEncrypter -> bufio__ptr_Reader_Read -> bufio__ptr_Writer_Write -> bufio__ptr_Writer_Flush
main_Walkprocess extensions -> main_Extensions ‘
main_GetHomeDirretrieve a path to the home directory
main_PathExistsretrieve the path and check fi it exists
main_mainrun the main function of the ransomware
main_initinitialize main structures necessary for Golang malware execution
III. Ransomware: “main_RsaEncrypt” Function
The ransomware employes Golang prototypes for RSA and AES encryption as seen in the main_RsaEncrypt function:
////////////////////////////////////////////////////////////////////
//////////// “shifr” RsaEncrypt Function ///////////////
////////////////////////////////////////////////////////////////////
int __cdecl main_RsaEncrypt(int a1, int a2, int a3)
{
…

  while ( (unsigned int)&retaddr <= *(_DWORD )((_DWORD )__readfsdword(20) + 8) )
    runtime_morestack_noctxt();
  encoding_base64__ptr_Encoding_DecodeString(encoding_base64_StdEncoding, &word_61ABB6, 612);
  encoding_pem_Decode(v6, v7, v8);
  if ( v6 )
  {
    crypto_x509_ParsePKIXPublicKey((_DWORD *)(v6 + 12), *(_DWORD *)(v6 + 16), *(_DWORD *)(v6 + 20));
    result = v6;
    if ( !v8 )
    {
      if ( (ptrType *)v6 != &ptr_rsa_PublicKey )
        runtime_panicdottypeE();
      crypto_rsa_EncryptPKCS1v15(crypto_rand_Reader, dword_737014, v7, a1, a2, a3, v9, v10);
      result = v4;
    }
  }
  else
  {
    runtime_newobject(&errors_errorString);
    result = v5;
    *(_DWORD *)(v5 + 4) = 16;
    if ( runtime_writeBarrier )
    {
      runtime_writebarrierptr(v5);
      result = v5;
    }
    else
    {
      *(_DWORD )v5 = &word_60DA92;
    }
  }
  return result;
}
IV. Yara Signature
rule crime_win32_shifr_go_ransomware 
{
   meta:
      description = “Detects shifr Golang Ransomware”
      author = “@VK_Intel”
      date = “2019-04-09”
      md5 = “d4ec36d096ba761a1b2ee237d9a9865d”
   
   strings:

      // GO SETUP
      $g0 = “Go build ID” ascii fullword wide 

      // GO RANSOMWARE FUNCTIONS
      $func0 = “main.RsaEncPrivateKey” ascii fullword wide 
      $func1 = “main.RsaEncrypt” ascii fullword wide
      $func2 = “main.Generate” ascii fullword wide
      $func3 = “main.Stringify” ascii fullword wide
      $func4 = “main.encrypt” ascii fullword wide
      $func5 = “main.Walk” ascii fullword wide
      $func6 = “main.GetHomeDir” ascii fullword wide
      $func7 = “main.PathExists” ascii fullword wide
      $func8 = “main.WriteWithIoutil” ascii fullword wide
      $func9 = “main.GetRandomString” ascii fullword wide
      $func10 = “main.RemoveFile” ascii fullword wide
      $func11 = “main.main.func1” ascii fullword wide
      $func12 = “main.Walk.func1” ascii fullword wide
      $func13 = “main.init” ascii fullword wide

   condition: 
      ( uint16(0) == 0x5a4d and $g0 and
         ( 9 of ($func) )
      )
}
V. Appendix
’-----BEGIN RSA PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3EfFJR3q7IaRiArMPMXH\ndCnug5j6ZLLOBzwby3kJ968HlCqA3YfXNq9GNteDoHCRNrzrIQ2qm9Bhv8LX7ugd\nXTTh1YZ7l62l4AkpOpWq8OsHhjEfhRdrzZrfyeVp3OArci94vGkI2OOB94gps+wa\npFNBoeWlg5r2EFpcNSh1BoXNoEUg5WhHi2afh1lC16jeRhFdUFA0TCkpnZA0dcmN\nMiNHQyIV6I1BAg7hBgFePtcPURGsTheKUM8spQ3k2iStrrySrNXysRnc+p1XFlUA\nbYBgUV/ksQw/PlzLAVBZJor9m5Q0gdUnuqdz9S3wLb1wCl9Wl/i9k+RRVJNDlSIs\nHQIDAQAB\n-----END RSA PUBLIC KEY-----\n’

Email Account: [email protected]
BTC Wallet : 1CLWBxbBKddQTUuhsUsn8izq2crUAgGYZ1
Extension: .locked
Ransom Note: README.html
URL: http://193[.]56[.]28[.]203/ok
Directory: ProgramData Recycle.Bin

Template:
<html>
<head>
<title>
Recovery your files.
</title>
<style type=“text/css”>
 .main {height:auto; width:100%;word-wrap:break-word}
</style>
</head>
<body>
<font color=#8B0000>
<b>I am so sorry ! All your files have been encryptd by RSA-1024 and AES-256 due to a computer security problems.</b></br>
<b>If you think your data is very important .The only way to decrypt your file is to buy my decrytion tool .</b></br>
<b>else you can delete your encrypted data or reinstall your system.</b></br>
</br>
<h2>Your personid :</h2>
<div class=“main”>
<b>ITSSHOWKEY</b></div></br>
</br>
</br>
<h2>Decrytion do as follows:</h2>
<b>1. if you not own bitcoin,you can buy it online on some websites. like https://localbitcoins.net/ or https://www.coinbase.com/ .</b></br>
<b>2. send ITSBTC btc to my wallet address ITSADDR.</b></br>
<b>3. send your btc transfer screenshots and your persionid to my email ITSEMAIL . i will send you decrytion tool.</b></br>
</br>
</br>
<h2>Tips:</h2>
<b>1.don’t rename your file </b></br>
<b>2.you can try some software to decrytion . but finally you will kown it’s vain . </b></br>
</br>
</br>
<b>Anything you want to help . please send mail to my email ITSEMAIL.</b></br>
<b>Have a nice day . </b>
</font>
<body>
</html>

Article Link: https://www.vkremez.com/2019/04/lets-learn-deer-dive-into-golang.html