HardBit Ransomware Using Passphrase Protection To Evade Detection

   July 16, 2024  Posted in GBHackers


In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware doesn’t use leak sites or double extortion.

Their tactics include data theft, encryption, and ransom requests with threats of other attacks.

Cybersecurity researchers at Cybereason identified that HardBit ransomware has been actively using Passphrase protection to evade security measures.

HardBit Ransomware & Passphrase Protection

They talk through TOX which is a peer-to-peer messaging system. Although it is unknown what their initial infection method is, they seem to resemble LockBit Ransomware in some ways.

Their observed TTPs consist of RDP and SMB brute-forcing, credential theft utilizing Mimikatz NLBrute, and possible utilization LaZagne NirSoft tools.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files

They were known to download programs from picofile[.]com, a Farsi file-sharing site.

Open Ports Detected On The Brute Forcing Server (Source – Cybereason)

The threat actors used network discovery tools such as Advanced Port Scanner and KPortScan 3.0 to move through RDP, reads Cyberreason report.

They installed HardBit ransomware bundled with the Neshta virus, a tool that corrupts files and maintains the infection for a long time.

HardBit Packed Neshta Execution Flow (Source – Cybereason)

HardBit ransomware necessitates the input of an authorization ID and encryption key. It also turns off Windows Defender, stops services, and prevents system recovery by using BCDEdit, Vssadmin, WBAdmin, and WMIC in advance of file encryption.

HardBit Ransomware Execution Procedure (Source – Cybereason)

Binary unpacking is part of the complex ransomware process that includes file infection as well as manipulation of systems to ensure successful execution and prevent recovery.

HardBit ransomware selectively encrypts files, updates infected machines, and uses encrypted email contacts. It’s obfuscated with Ryan-_-Borland_Protector Cracked v1.0, a modified ConfuserEx. 

The GUI version offers ransom and wiper modes, with wiper mode requiring additional authorization. Configuration file hard.txt can enable wiper mode. 

HardBit has evolved through versions 2.0, 3.0, and 4.0, with increasing sophistication in functionality and obfuscation techniques.

Recommendations

Here below we have mentioned all the recommendations:-

  • Enable Application Control to block execution of malicious files.
  • Activate Predictive Ransomware Protection.
  • If Predictive Ransomware Protection is unavailable, enable Anti-Ransomware.
  • Enable Variant Payload Prevention on your security solution with Prevent mode.

“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo



Source link