I Reverse Engineered a Dangerous Virus and Found Something WEIRD (ESXiargs ransomware deep dive) 

wanna learn assembly? check out my courses at lowlevel.academy

Honestly, the large font size is useful on larger screens as well! Much, much easier to read.

Maybe they left the debug symbols because they knew that even when you disassemble it, you won't be able to extract any information that could help the victim. I.e. it was a "flex".

Considering the part that causes actual harm is an unobfuscated *bash script,* it's pretty safe to say that leaving symbols in their generic encrypt/decrypt binaries wasn't a consideration.

Keep the cybersecurity stuff coming 😎

Thank you triple L. Loving the cyber security content! Keep it coming.

common lowlevellearning W

Thank you for the big fonts!! I wish the other RU-vidrs would do this more: I only consume content from my phone and it’s always hard to read.

Thank you LLL

Great video, this has been on my mind though: Why would a ransomware writer want to obfuscate their code? If their main goal was to collect ransom, and the program was cryptographically secure, wouldn't they want to lay out everything they did in an easy to understand way? Beeing able to see exactly how I was pwned would give me at least a little bit more confidence that I would get a key in exchange for money.

They made the binaries easy to use because they wanted you to know that there is no backdoor, you need to get (ie. pay for) the private key.

very nice code! I've seen corporate code that looked worse than this malware. Also: security lives from openness. The symbols were left in, so you could read it. And if you had found a bug, only then they could have improved your malware ^^

3:57 *Missing summary:* There are two types of encryption: * symmetric, and * asymmetric. *Symmetric* cryptography uses the *same key* for encryption and decryption. *Asymmetric* cryptography has the *key split in half:* a public key and a private key.

I think they can leave the debug on because anyone analyzing the binaires will just learn that he cannot actually decrypt the files without the private key. The sooner the victim realizes that he cannot decrypt the files without the private key, the better for the scammer. The scammer could truly send the source code that it wouldn't matter. As for obtaining the private key form the public key, that is possible in theory. However, you won't be able to find the private key in practice unless the key is way too small (which is unlikely) or has been made by a program that is way way too predictable in how it generates its keys (and you know or guess that that program has been used to create the key) . You could wait until quantum computers with as many quantum bits as the public keys are a real thing (and boy that will be a mess when they reach that stage...) but that might be a long wait... As for using modern supercomputers, you are very unlikely to find the private key with them unless it was generated using some weak algorithms.

Great video! 4:14 Large font is very much appreciated but 64 pt is maybe a tad TOO large. 48 pt or 56 pt might be a better compromise. 5:32 Also, maybe make your camera be a slightly smaller circle and move it up to the right so it doesn’t obscure the code

Thank your triple L

This part of the malware is not the valuable part. This is just some basic encrypt / decrypt software that probably took them like half a day to make. Hell I'm surprised they didn't provide a readme / documentation for how it works. After all, their goal is to convince you that you'll get your stuff back if you pay the ransom. The real important part is how they got the files onto your server and ran them. That's the secret part that I'm sure they'd want to protect.

Obviously the people making this were just shitty script kiddies. Not only did they not strip their code and left the debug info in it, but you can clearly see that their code is absolute garbage as well. Anytime you have to commit the crime of nesting 5 or 6 "if else" statements you know your code sucks.

Was the "encrypt" command really malware though? It looks like a useful cli tool for legitimate purposes, and maybe it's open source software that they pulled off someone's github - in which case they wouldn't care if someone gets into the source code.

I just wanted to take a moment to express my appreciation for your incredible RU-vid channel. Your dedication to teaching low-level programming concepts and techniques is truly inspiring,. I would love to hear your personal story about how you learned reverse engineering, and any tips or advice you have for people who are just starting to explore this topic, and thank you.

I think, even stripped binary without debug info would have symbol table. Due to external linkage in C/C++ for main function, you'll see it there as it is required for possibility of late symbol resolution (e.g. substituting original main with something else during run-time).

It seems like the authors took "security through obscurity isn't security". I mean, having it not obfuscated probably lets the victims know there is no other way than paying up, and prevents wasting everyone's time I guess. And it also makes it abundantly clear that the only way out is the private key, and could also be a way to tell "lmao it's so simple, babies could write this encrypt binary, get rekt lol", so maybe a flex there too, I guess? This shows that the actual "malware" isn't advanced, the way they got it in is. And honestly, bringing light to this is the good part. Because let's face it, most OSs these days have good protection. The only "vulnerability" is probably the organization and/or the humans in the gears.

They use rsa_encrypt directly on a blank symmetric key? Did you check the public key for having a low exponent e? If it's 3 or 7 you might just be able to take the 3rd or 7th root of the value to get the symmetric key out.

If they give you the private key, wouldn't that mean that you could just share it and everyone else will be able to decrypt their files? Also, I think the thing I was most curious about was how they encrypt the file in place. The cryptography stuff seems like they are just using standard stuff, seems unlikely they would mess up there. BTW, wouldn't they want for people to be able to inspect the code at some extent? If you are confident that the code will actually recover your files you're more likely to pay than if you suspect the files may just been overwritten entirely and are now impossible to recover. Leaving debug info may be intentional. There's nothing to hide there anyway, they are doing exactly what you'd expect and the only solution is paying them.

As someone who often watches on his phone, I appreciate the effort, but you don't need the font THAT big. If you're watching a programming video in portrait mode on your phone you're doing something wrong. Also, "with debug_info, not stripped" LOL. I'm no infosec/reverse engineering guy, but seeing that in malware is hilarious.

Why should they strip their code? If it is secure, then this information is useless anyway?

4:06 - what? no. You encrypt using the public key, needing the private from them. - If you encrypted with private key, you could decrypt it with the public key :D (if it's possible at all) EDIT: yeah, ok, sorry, you corrected yourself. It was just a slip of the tongue.

LLL Is the best! Thank you! Just a question, the name of disassembler software that you use is "Ghidra" ?

love this type of content !

Thank you triple L! Excited for more rev content! Also binary exploitation and other cyber subjects would be cool

So basicly remove the option to set a private/local key without permission and 90% of all programs dont work anymore xD

They bought the code. They didn’t write it themselves and must pay a fee to the script writer. The signatures are to ID the program and who must be paid.

Ok, I didn't expect a simple open bash script doing a lot of it. Possibly explains why there was a lot of seemingly rookie moves in the encryption code. I suppose it does what it needs to do to accomplish what they're trying to get done. It will be enough to get a result from most people and businesses.

So the only weird thing was the presence of debug symbols? I was expecting _a lot_ more with such a clickbait title. This ended up just being a walkthrough of the most basic steps for how _ordinary_ encryption/decryption works, and barely even that.

One problem: first "customer" who pays up has now the decryption key that can be used to help all other victims of this particular copy of the malware. Unless they use different public keys for all of their victims, which seems to be not very practical.

They don't care if you have the encryption/decryption algorithm since it doesn't do much good without the private key. It seems unlikely they're "mad at you". Still, an interesting video.

Great content man, nice work!

They can run just string reversion, for example taking some strings from the end of file and putting it to the start of file, so you cant open it, and mention that it's strongly encrypted. ive got a ransom like that once. Its time saving, when you need to corrupt large amount of data, before ransom to be found

Hey Lx3, thanks for enlarging the text so I can see it on my phone. Not that I have any idea what any of it means, it's just nice to know that you're thinking about your audience. Good form, brotha. Bravo.

Conclusion: Nothing weird or unexpected. On a side-note, if more linux programs were made this way, where they scan for the libs they need and then check each lib to ensure it has what they need, they'd save people a lot of headache with the perpetual fail of libs and their dependencies, and the various versions of them, which often make it difficult to produce an executable that "just works" regardless of the distro.

Thank you for the big fonts, makes it more accessible, I have difficulty reading small fonts!❤

If all universities taught like this, we would have a much difficult time getting jobs...

Thanks for the big font - nice video, strange that though debug symbols show the variables with strange names...

Thank you for the font size! - and also for the great content in general 🙂

props to you for including mobile/partially blind accessibility

Hey, cybersec engineer student here poking around with reverse engineering. Love the quality of the content! I'd love to try and apply my knowledge on some malware reversing. Is there any (softly) obfuscated malware that you would recommend to play with?

So we're a further four years down the road from when this was first published on RU-vid, and it is more on point than ever, Italy has once again elected a fascist leader, the USA is literally torn in half by misinformation, and hatred, and the lie still thrives, and Russia, of course, has decided to re Annex countries they once occupied as part of the Soviet union. Your work presented here, is a reminder of how easily it is to deceptively lead people to extremism, forcing the idea that it is their only way for survival. This was done in the thirties, without the entrancing tools of social media, I wonder what chances we have today. Thank you for making this.

back around 2014 I started seeing a lot of decisive memes on social media. I usually tool about 10 minutes with strings to isolate the localization info for the software used to edit the image. I was not surprised to find Chinese and Russian locale codes and quite surprized to find Hebrew and Macedonian localization in a lot of the memes

Thank you LLL, as a mobile consumer it’s appreciated

Yessss!! More security stuff! I'm trying to learn it, but it's tough, lots to learn!

Love your LL system-related content, could you do one regarding how to use the core dump of a segfaulted C executable? I'd love your explanations on that.

I could not follow anything in this video, it could have been in Swahili as far as I'm concerned but still, I subbed, liked and watched the entire thing because it was fascinating! And because you asked, thank you LLL!

The concept of the series is nice but the example is not great. You can tell exactly what the binaries do just from looking at the shell script, and it doesn't really help to have debug symbols etc because what you really need is the private key. They pretty much could have done the same thing using readily available cli tools. It would be nice if you could show examples where reverse engineering lets you fix the damage because they have done something stupid like embedded the key in the binary etc, but I don't know how easy it is to find examples of that kind of thing.

This was 12 minutes of recommended video, that I watched and said "I'll take your word for it"🤣🤣

Thank you LLL!!! Seriously bro, that move is next level! That is how you take care of the peeps consuming your content. This is the first video I have seen of yours but I have subbed and liked this vid. Keep killing it!

Leaving the debug information in the executable does not help you decrypt the data. What it does do is help you to find out that the crypto it is using is asymmetric and likely robust, which actually pushes you to wanting to get the private key. So really the debug information helps the attackers.

People who got hit by this ESX attack should be fired. The version that was touched by this attack had been release in december 2020 for 7.x and february 2021 for 6.7 ! They were a year late in patching

TI teacher : don't use lot's of IFs Virus maker: 5:56

they left the debug info to prove that if they give you the private key, you can build a decrypter by yourself, so you know that there is something to buy. quite smart. also if you buy the decript key but you don't have a way to verify or build by yourself the decrypt program, the effort to write a decryptor could be significative and also you may not trust the decrypted data and then make less likely to buy the key. i think that it is really to make you to buy the key, and it is a very smart move.

I have no idea about cyber security, but wouldnt the actual important part about this type of malware be how they get write access to your data?

why should the attacker care if you reverse engineer their binary? 2:47 - They don't want you to find the vulnerability that gave them exec permission on the host. And they don't want the channel used for money transfer to lead to their identity. That's all. - Antivirus people will find a way to fingerprint the binary regardless of it being stripped or reverse engineered or what not. - If the data is "properly" encrypted, it doesn't matter that you know the alg - without the key you cannot do anything anyway.

If ESXi has the openssl binary installed by default, they didn't even need to go to the effort of building this very simple binary that uses the OpenSSL library.

As someone who's recently been getting into the low-code/JS space due to work, this was very interesting, as you covered the main functions and described what they do, leading to better understanding! Got a subscribe from me.

The large font is great for my phone so thanks, but also great for my TV so thanks again. Double thanks for you my good sir!

Good stuff. Still eagerly awaiting part 2 of the baby monitor pen testing too 😉

@4:20 ,while watching from phone, Thank You. :)

Correct me if I’m wrong (probably am) but the random bytes is the initialisation vector for each chunk? (9:20)

Judging from this dive, it sounds like the ransomware does have one weakness*: as long as the binary depends on a static private key, once that key is out in the wild, basically anyone can "pirate" the key causing that specific binary to be easily defeatable. Obviously the author would want a decent windfall before that happens. And * it's not a cryptographic weakness of the code itself, but rather a social-engineering one.

I would love to see death penalty for those who write ransomware and malware.

Hay. Thank you for increasing the font size. I appreciate it. ~♡

that code in itself isnt ransomware. how it was used is. this would explain why they didnt bother removing the symbols. it wasnt initially designed for what it is being used for.

It would be very nice if you would summarize your result and present it in a simpler way. You explain everything very well but also very fast with jumping around in Ghidra. I would like to see some summary after all the code like: The program does: 1. This 2. This 3. This to archieve This and this... You could then explain a bit more detailed what all this means and also reach people who are not so much into the topic or don't know, for example, how SSL or asymmetric cryptography works. I'm a programmer but not a Security Analyst and would love get more background knowledge and information from your videos. Anyway. Very cool video definitely a subscription from me.

Thank you for the huge font, my laptop is upstairs.

I was promised something weird. This is false marketing.

Would be interesting to see how the malware gets onto the system in the first place.

I didn't know scammers actually provide decryption after payment.

Two questions about how this scam works. One, how do the scammers have the decrypt key but the victim does not? And two, is that key unique per victim? If not, the scammer should expect to only sell one key.

The one thing I never understood about the "give me money and I will send you the key" malware was, why? once i have your money what do i care?

Thank you LLL for the large font

how are all the comments so positive? ... this video wasn't bad, but it was .... pointless ... - they are just normal well written (en/de)cryption binaries that have nothing to do with any malware... except for being used by it. - I guess it makes sense to look for bugs in the sw they used, if it can be exploited. Anyway, I wrote so many comments, I feel kind of toxic nad bad; sorry about that; but honestly ... I'm not sure why, but this video annoyed me so much ... I wish everyone to be happy, I don't want to bash on anyone ... but this video was so ... borderline nonsense... and I didn't even expect too much...

Thanks L³ for the large font

Thanks for the larger font size!

what was the something WEIRD? the debug symbols?

The faster they know that the cryptography is sound the faster they pay

I haven't a clue about any of this. To me it appears as a "This is what you did wrong" lesson, get it right next time.

You know what people I commented on a lot of videos about not being able to read them and stuff. This is the first content creators that I ran into that's actually blown it up for the people that have to use the phones that are too poor for the internet. So just content creator on the sign up for that thank you for considering us is part of your viewing group.

The debug info was probably intentional so it’s easy to see it’s cryptographically sound to anyone trying to analyze it. It doesn’t make the security any weaker, right?

With debug info not stripped, that's luxurious :D Also, thanks youtube algorithm for recommending this!

1 font size step down would have been better imo, but great video, thanks!

I'm surprised it wasn't full of fake variables and useless functions to obfuscate what it actually does.

Well they are certainly going with the No Security Through Obscurity Principle.

imagine when AI starts writing viruses and malware and it starts infecting everyone's divices. "you humans think you're so smart. you aint sh*t, watch this..." *infects almost every device in existence with malware*

Thanks for the font size!

Thanks LLL, I didn't know what I was taking for granted.

I have been coding in assembly since the late '70s, working with processors like 8088/86. One effective method to avoid dealing with semi-script kiddie activities is to restrict access to specific files through a tunneling script stored in the RAM. There are various ways to achieve this using concise code snippets. It seems like the world has it backward; instead of preventing such issues with straightforward methods, many rely on extensive, advanced, and expensive antivirus software. What's the point?

Ok, now that was jumping straight in from the first second of the clip. I assume this clip comes from a firm of context that we are supposed to recognize. I also assume that you assume that all of us are using a Windoze computer. I might be wrong, though, since I have no idea what is going on. A bit of context would have been nice.

With the binary having debug and unstripped and also being compiled for a ancient version of Linux and also relying on local shared libraries instead of being statically linked, this really tells me these guys did not actually write this program and probably just found it online from some other person who wrote a generic file encrypter for there own use, esp also since there is literally useage info in the binary in such a way that screams this is a amateur programmer who wrote this binary. Hell it looks like something I would write to just screw around with encryption and decryption stuff...

I don't about Linux, but Windows has a scale function to make everything bigger or smaller. Quite useful for video presentations. And yes, big font is always big plus in terms of readability no matter screen size.

Loved what I could watch of the video, but RU-vid was running 30 seconds of ads for every 1:30 seconds of content. It just made the video unwatchable.

I'm rarely watching your Videos on my phone, but this time I was, thanks :)