Skip to content

WannaRen預警偵測通報

最近發現WannaRen勒索病毒肆虐,各處災情頻傳。Version 2 Limited為ESET總代理,彙整以下偵測預防方案,供各位參考預防、避免遭受WannaRem攻擊。

1. 以下三個已知的WannaRen勒索軟體的Hash,ESET防毒已可偵測到,並有效的阻攔。
1de73f49db23cf5cc6e06f47767f7fda
46a9f6e33810ad41615b40c26350eed8
235cca78c8765fcb5cf70a77b1ae9d02

2. 已知Windows系統中會遭受感染的檔案之Hash如下:
WINWORD.EXE CEAA5817A65E914AA178B28F12359A46
wwlib.dll 9854723BF668C0303A966F2C282F72EA
you 2D84337218E87A7E99245BD8B53D6EAB
nb.exe CA8AB64CDA1205F0993A84BC76AD894A
officekms.exe 39E5B7E7A52C4F6F86F086298950C6B8
WinRing0x64.sys 0C0195C48B6B8582FA6F6373032118DA

3. 已知會散佈WannaRen勒索軟體的位置:

4. 已知會以釣魚方式寄送郵件,誘使使用者點擊連結去下載勒索軟體的位置:
5.101.0.209、5.101.1.209、217.12.209.234、91.215.169.111、193.33.87.219

建議:
1. 於ESET防火牆或Windows防火牆中直接阻擋這些位置:



和這些IP。
5.101.0.209、5.101.1.209、217.12.209.234、91.215.169.111、193.33.87.219

2. 搜尋電腦中的WINWORD.EXE、wwlib.dll、you、nb.exe、officekms.exe、WinRing0x64.sys,並提交給ESET分析,確認是否真的已遭受感染。

3. 以上Hash或IP與網站位置,可以透過IPS/IDS製作偵測規則,透過IPS/IDS進行預警與防禦。以下是以SNORT為範例製作的偵測參考規則:
alert tcp $HOME_NET any <> $HOME_NET any (msg:”Deleted: Payload Ransomware Detected”; flow:from_server,established; content:”|0C0195C48B6B8582FA6F6373032118DA|”; depth:500; metadata:created_at 2020_05_04, updated_at 2020_05_13; priority:1; classtype:malware-cnc; sid:1002000346; rev:12;)


About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於ESET
ESET成立於1992年,是一家面向企業與個人用戶的全球性的電腦安全軟件提供商,其獲獎產品 — NOD32防病毒軟件系統,能夠針對各種已知或未知病毒、間諜軟件 (spyware)、rootkits和其他惡意軟件為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少,偵測速度最快,可以提供最有效的保護,並且比其他任何防病毒產品獲得了更多的Virus Bulletin 100獎項。ESET連續五年被評為“德勤高科技快速成長500 強”(Deloitte’s Technology Fast 500)公司,擁有廣泛的合作夥伴網絡,包括佳能、戴爾、微軟等國際知名公司,在布拉迪斯拉發(斯洛伐克)、布裏斯托爾(英國 )、布宜諾斯艾利斯(阿根廷)、布拉格(捷克)、聖地亞哥(美國)等地均設有辦事處,代理機構覆蓋全球超過100個國家。

Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia

The analysis is the result of joint research between ESET and Avast

BRATISLAVA, PRAGUE
 – ESET recently teamed up with Avast to research a widespread and constantly evolving remote access tool (RAT) with the usual backdoor functionality that ESET has dubbed Mikroceen. In the joint analysis, the researchers uncovered Mikroceen being used in espionage attacks against government and business entities (from the telecommunications and gas industries) in Central Asia.

The attackers were able to gain long-term access to affected networks, manipulate files and take screenshots. Victims’ devices could execute various commands delivered remotely from command and control servers.

The researchers investigated the custom implementation of Mikroceen’s client-server model, purpose-built for cyberespionage. “The malware developers put great effort in securing the client-server connection with their victims. Their malware was leveraged ‘in the wild,’ as the operators managed to penetrate high-profile corporate networks. We also saw a larger attack toolset being used and constantly developed, which consisted mainly of variations in obfuscation techniques,” comments Peter Kálnai, who led the ESET arm of the joint research team.

Mikroceen is under constant development, and security researchers have seen it used with backdoor capabilities in various targeted operations since late 2017. Among the tools used by the attackers to move within the infiltrated networks, ESET and Avast researchers also identified Gh0st RAT, an older, yet infamous, RAT created around 2008. There are many similarities between Gh0st RAT and Mikroceen, with the main shift between the projects in securing the connection with a certificate.

For more technical details about Mikroceen, read the blog post Mikroceen: Spying backdoor leveraged in high profile networks in Central Asia on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET Research discovers cyber espionage framework Ramsay

Bratislava, Montreal – ESET researchers have discovered a previously unreported cyber espionage framework they dub Ramsay. The framework is tailored for collecting and exfiltrating sensitive documents from air-gapped systems that are not connected to the internet or other online systems. Since the number of victims so far is very low, ESET believes that this framework is under an ongoing development process.

“We initially found an instance of Ramsay in a VirusTotal sample uploaded from Japan that led us to the discovery of further components and other versions of the framework along with substantial evidence to conclude that the framework is still in a developmental stage, with delivery vectors subject to fine testing,” says Alexis Dorais-Joncas, head of ESET’s Montreal-based research team.

According to ESET findings, Ramsay has gone through several iterations based on the different instances of the framework found, denoting a linear progression on the number and complexity of its capabilities. The developers in charge of infection vectors seem to be trying different approaches, such as using old exploits for Microsoft Word vulnerabilities from 2017 and deploying trojanized applications for delivery, potentially via spear-phishing. The three discovered versions of Ramsay differ in complexity and sophistication, with the latest third version being the most advanced, especially with regard to evasion and persistence.

Ramsay’s architecture provides a series of capabilities managed via a logging mechanism:

  • File collection and covert storage: The primary goal of this framework is to collect all existing Microsoft Word documents within a target’s file system.
  • Command execution: Ramsay’s control protocol implements a decentralized method of scanning and retrieving commands from control documents.
  • Spreading: Ramsay’s embeds a component that seems to be designed to operate within air-gapped networks.

“Especially noteworthy is how the architectural design of Ramsay, especially the relationship between its spreading and control capabilities, allows it to operate in air-gapped networks – meaning networks that are not connected to the internet,” says Dorais-Joncas.

For more technical details about Ramsay, read the blog post Ramsay: A cyber espionage toolkit tailored for air-gapped networks on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET upgrades security management for organizations running Microsoft Azure

Bratislava – ESET has upgraded its Security Management Center for Microsoft Azure, providing organizations with complete, real-time network visibility and allowing them to oversee thousands of servers, desktops and mobile devices via a single pane of glass.

ESET Security Management Center for Microsoft Azure is a cloud-based management solution that gives businesses the capability to deploy, update and manage all ESET security solutions from a single console. The upgraded management console is ideal for both small and large organizations already utilizing Microsoft Azure, and requires no additional hardware or license fees.

The comprehensive solution enables businesses to easily manage all physical and virtual desktops and servers running on Windows, macOS and Linux, as well as supporting full Mobile Device Management (MDM) of Android and iOS devices. ESET Security Management Center seamlessly combines the management of multiple endpoint products, including ESET Enterprise Inspector and ESET Dynamic Threat Defense in one easy-to-use hub, also accessible via browser. This means organizations are equipped with multilayered protection that addresses the key tenets of a strong cybersecurity strategy: threat prevention, detection, assessment and response.

In addition, the solution features a fully customizable notification system, allowing users to configure notifications with the exact information they wish to be notified about.

Igor Hula, Product Manager at ESET, commented: “We are dedicated to providing our users with the very best in IT security, and our wide range of product offerings for a variety of platforms and devices exemplifies this. We believe every business should be equipped with cutting-edge technology in order to keep both their employees and customers safe and secure, and we are continuously improving and adapting our solutions to ensure this. It is vital that businesses of all sizes are supported by a comprehensive cybersecurity strategy – advanced and easy-to-use solutions mean businesses can focus on their goals, knowing they are securely protected.”

For further information on ESET Security Management Center for Microsoft Azure, please click here.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Internews and ESET develop security partnership to protect human rights defenders

Bratislava – Global nonprofit Internews has partnered with cybersecurity company ESET to distribute antivirus software to civil society and at-risk groups worldwide. The pilot project will protect more than 1000 devices, reaching a network of journalists, human rights groups, and members of civil society who are highly vulnerable to digital threats.

“These licenses will fill a critical gap among the most at-risk communities around the globe,” said Megan DeBlois, Information Security Advisor at Internews. “The consequences of online attacks against human rights defenders can be life altering — leading to silencing, arrests, or worse. We’re grateful to partner with ESET for helping us provide stronger protections to human rights defenders at such a vital time for information provision.”

Internews supports media organizations and other information providers globally with resources, training, and funding so they can deliver trustworthy and accurate information to local communities. This includes providing direct technological support to those working in some of the most restrictive regimes worldwide.

“We’re thrilled to be working with Internews to help better protect those on the front lines, the people providing information at this time of crisis,” said Alexis Dorais-Joncas, Security Intelligence Team Lead at ESET. “First responders in human rights communities often operate with very limited resources while they face some of the most advanced and dedicated threat actors. It’s meaningful to all of us at ESET to be able to support these communities with high-quality tools and protections that might not be available to them otherwise.”

“This pilot project with ESET enables beneficiaries to access antivirus tools which are otherwise prohibitively expensive, limited to free-tier services, in short supply for NGO licenses, and/or reliant on advertising models,” said Jon Camfield, director of Global Technology Strategy at Internews. “While antivirus is not a cure-all or appropriate for all threat models, it is a critical tool for reducing risk.”

The Internews/ESET partnership is intended to strengthen connections between civil society and the private sector, enabling a greater exchange of ideas and needs from end users to tech developers. This connection is a core principle of Internews’ global technology efforts.

“Identifying and flagging malign actions helps improve security for everyone, not just the individual or group targeted,” said DeBlois. “As companies like ESET have greater visibility into the offensive tactics being deployed against civil society, they’re even better equipped to design effective defensive strategies to protect all users from these advanced threat actors.”

The initiative comes as cyberattacks are on the rise as more and more people move to operating online in response to the COVID-19 situation, and forms part of Internews’ broader work in ensuring vital information can reach all sectors of society at this crucial time. 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.