MazeRansomware 4263eacd -- RSA2048-ChaCha20 DECRYPT-FILES-txt WMI-Win32ShadowCopy-delete autorun-inf-USB InternetOpenA-HTTP-C2 CryptAcquireContextW 1-section-PE | Kritik

Fichier Kimligi

Maze Ransomware Kimlik Dogrulama

Maze Ransomware  <- ailenin kendini tanimlayan string\n.Logging enabled | Maze <- internal debug logu\nDear %s, your files have been encrypted by RSA-2048 and ChaCha algorithms\nDECRYPT-FILES.txt   <- fidye notu dosyasi\nSo we will give you appropriate price for recovering <- odeme tehdidi

Sifreleme Architecturesi

RSA-2048 + ChaCha20 hibrit sifrelemesi:\n  1. RSA-2048 ile ChaCha anahtar sifrelenir\n  2. ChaCha20 stream cipher ile dosya icerikler sifrelenir\n  3. CryptAcquireContextW + CryptGenKey + CryptEncrypt/CryptDecrypt\n  => Ucretsiz kurtarma IMKANSIZ (ozel anahtar olmadan)

VSS ve Yedek Silme (WMI)

WMI uzerinden Volume Shadow Copy silme:\n  select * from Win32_ShadowCopy\n  "%s" shadowcopy delete\n  Win32_ShadowCopy.id=\'%s\'  <- her VHD snapshot silindi\n\ncmd.exe kullanmadan WMI ile gerceklestirilir -> EDR tespiti zor!

Ek Yetenekler

autorun.inf         <- USB/removable media ile yayilma\nEncrypting: [yol]   <- canli sifrelememe logu\n--path parametresi  <- hedefli dizin sifrelemesi\nEncrypting whole system <- tam sistem sifrelemesi\n\nHTTP C2 (network comms):\n  InternetOpenA / InternetConnectA\n  HttpOpenRequestA / HttpSendRequestA

IOC