NightSky/nightsky.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "c5f6e5b5-4b11-4ccc-b789-2d86591b385d",
   "metadata": {},
   "source": [
    "# Night Sky Ransomware\n",
    "\n",
    "Sample (packed): `8c1a72991fb04dc3a8cf89605fb85150ef0e742472a0c58b8fa942a1f04877b0`\n",
    "\n",
    "Sample (dumped/unpacked): [`1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577`](https://malshare.com/sample.php?action=detail&hash=1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577)\n",
    "\n",
    "References:\n",
    "- [First seen from MalwareHunterTream](https://mobile.twitter.com/malwrhunterteam/status/1477381209147723788)\n",
    "- [Sample VT](https://www.virustotal.com/gui/file/8c1a72991fb04dc3a8cf89605fb85150ef0e742472a0c58b8fa942a1f04877b0)\n",
    "- [Sample Malshare](https://malshare.com/sample.php?action=detail&hash=9608c8b6c8d80fdc67b99edd3c53d3d2)\n",
    "- [Malware Bazaar](https://bazaar.abuse.ch/sample/8c1a72991fb04dc3a8cf89605fb85150ef0e742472a0c58b8fa942a1f04877b0/)\n",
    "- [id-ransomware](https://id-ransomware.blogspot.com/2022/01/nightsky-ransomware.html)\n",
    "\n",
    "\n",
    "## Dynamic Analysis\n",
    "- Drops `hta` ransom note in every directory (`NightSkyReadMe.hta`)\n",
    "- Uses `.nightsky` file extension for encrypted files\n",
    "\n",
    "## Unpacking\n",
    "The sample is packed with some version of VMProtect, likely a newer version (3?) but I'm unsure. It seems to have some anti-debug that actually works against [ScyllaHide](https://www.patreon.com/posts/installing-to-57091901) but luckily it will run with a debugger attached. [MrExodia](https://twitter.com/mrexodia) confirmed that the entrypoint was virutalized but we discovered that the main funcationlity was not. This allowed us to break in the main functionality and use [vmpdump](https://github.com/0xnobody/vmpdump) to dump the payload and resolve the imports. \n",
    "\n",
    "## Static Analysis\n",
    "The code is strightforward but it contains a statically linked [mbedtls](https://github.com/ARMmbed/mbedtls) library. To assist with reverse engineering we used lumina to pull down some function names for the mbedtls functions, and we compiled version `3.0.0` of mbedtls and imported the `.pdb` file to give us access to the library structs in IDA. "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cca25dbf-acf9-4558-a1ec-f560ad739948",
   "metadata": {},
   "source": [
    "## OSINT\n",
    "\n",
    "It seems as though this might be a updated version of Rook Ransomware (January 8, 2022).\n",
    "\n",
    "[Tweet from @vinopaljiri](https://twitter.com/vinopaljiri/status/1480059715392622597)\n",
    "\n",
    "> Many researchers are spreading something what is not true.. Please repair your analytical conclusions.\n",
    "#Rook #ransomware is basically previous version of new #NightSky - delivered VMProtected (will be shared later).\n",
    "Facts about #Rook in pictures!!!\n",
    "\n",
    "<img src=\"https://pbs.twimg.com/media/FIo6BoiXEAICKY8?format=png&name=large\" \n",
    "alt=\"IMAGE ALT TEXT HERE\" border=\"10\" />\n",
    "\n",
    "<img src=\"https://pbs.twimg.com/media/FIo6DG0WYAIDabX?format=png&name=large\" \n",
    "alt=\"IMAGE ALT TEXT HERE\" border=\"10\" />\n",
    "\n",
    "<img src=\"https://pbs.twimg.com/media/FIo6D21WYAQMC3D?format=jpg&name=large\" \n",
    "alt=\"IMAGE ALT TEXT HERE\" border=\"10\" />\n",
    "\n",
    "<img src=\"https://pbs.twimg.com/media/FIo6EzrWQAEymZh?format=png&name=medium\" \n",
    "alt=\"IMAGE ALT TEXT HERE\" border=\"10\" />\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "58b1ac1b-5385-476b-9962-b72782bc2369",
   "metadata": {},
   "source": [
    "## Dynamically Extracted IOCs\n",
    "\n",
    "RSA Public Keys\n",
    "```\n",
    "-----BEGIN PUBLIC KEY-----\n",
    "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwetDt+9kp5JJGCb3YrqH\n",
    "48g0rxFIaj5/NjMBvxtpa+7nO/lS0FQXxWJO78dTT6xW/UgVLPK4MvbGeIj17aQF\n",
    "SqGHbRxTeoPrHufp4sM4J2IQYLc6YLYZMS6XT02rHOjumBJpEKyROQ+df5KU/06o\n",
    "Rrhljc0Qco+qW8q/xYJQ9VFa87IJM6WM3wsydHVDDeGuWi4/PMUT4/GAa8/WMUYW\n",
    "9Ebw7/hXd/aNX5LykeonN+nkJfbj1fZNTU81tc8Kx4rykLvMVE1H3AaT5ssCBt7p\n",
    "AFkLLjplOXz3XmhH+J5vm5Ifi7T85j4D6O03qocO2gwezIikCDU2YAOOpJzkb5Ab\n",
    "+wIDAQAB\n",
    "-----END PUBLIC KEY-----\n",
    "```\n",
    "\n",
    "```\n",
    "-----BEGIN PUBLIC KEY-----\n",
    "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnw/AqzVYc7H6A34K3MQ6\n",
    "J8nJeaCSegiSOIjhxveQeocKp6TzvL6W3usuMbJKGfL9b19KkiYYyK0WAJ/gsIpq\n",
    "DH7xLCeOq8Lttp07PJmpyOLzzSyuSRKY3E7uSATXMzvJq4OuIkAcwWdce8OnQfS0\n",
    "17VxNISQU6XQMjt81sqHTzvmg3DaeoqGb1oISWyDoRMFd5Akt04Iw//aNIoGIBvh\n",
    "e/HP71LQpbyzb0RY0HBQuk3zlIDK6J5Hvr+Bkd4Tr5oh/oBya6RX7gW5t1FkY42c\n",
    "/maunB4PiPgHiPdHtJ1LQE+EtSLWU4ZCc0finaLBh3ooySIcsLP9ehlWds1h1ZWN\n",
    "2QIDAQAB\n",
    "-----END PUBLIC KEY-----\n",
    "```\n",
    "\n",
    "**TODO: Why are there two RSA keys?**\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f2e45893-f95c-4cd7-8074-e957c5052a80",
   "metadata": {},
   "source": [
    "### Ransom Note IOCs\n",
    "\n",
    "```\n",
    "Contact information \n",
    "Web Chat: \n",
    "You can use the username and password provided by us to login to the chat room to communicate with us.\n",
    "URL:https://contact.nightsky.cyou\n",
    "username:user-kdwckin\n",
    "password:kdjfikerjijJHDUFIGjk3289\n",
    "Email: \n",
    "You can contact us by email.\n",
    "EMAIL ADDRESS:akij@nightsky.cyou\n",
    "\n",
    "--------------------------------------------------------------------------------\n",
    "\n",
    "Data release website \n",
    "Where we use to disclose the data of customers who do not pay \n",
    "http://gg5ryfgogainisskdvh4y373ap3b2mxafcibeh2lvq5x7fx76ygcosad.onion \n",
    "--------------------------------------------------------------------------------\n",
    "\n",
    "Remark \n",
    "How to access dark web sites:https://www.youtube.com/watch?v=NpXEQHDOA5o \n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "664f4e7b-8ccd-4ef3-88dc-85fc299727d2",
   "metadata": {},
   "source": [
    "## Mutex\n",
    "The mutex `tset123155465463213` is used to prevent multiple cuncurrent versions of the ransomware. This might be a nice vaccine?\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9853945e-8d53-4a17-8647-759a345826e0",
   "metadata": {},
   "source": [
    "## Encryption\n",
    "\n",
    "**TODO**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "24dffd3c-6340-41e2-99cf-fe93c053987a",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.5"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}