Analysis

The advent of the Sphynx strain of the BlackCat ransomware demonstrates how cybercrime strategies are always evolving. Sphynx seeks to get past security precautions and accomplish its objectives by concentrating on speed and stealth. This updated version, which has trash code, encrypted text, and revised command line parameters, improves the group's evasion tactics. Sphynx also encrypts files, does network discovery tasks, drops a ransom letter, and has a loader for decrypting the ransomware payload. Despite efforts by law enforcement, the ongoing danger posed by BlackCat and its twofold extortion scheme, as well as the professionalisation of cybercrime motivated by monetary gain, underscore the ongoing difficulties that organisations confront.

Prevention

• Review user accounts for unauthorized additions.
• Back up and password protect data offline.
• Implement network segmentation.
• Maintain multiple secure data copies.
• Keep systems and software up to date.
• Use multifactor authentication.
• Regularly change and avoid reusing passwords.
• Disable unused remote access and monitor logs.
• Audit and limit administrative privileges.
• Install and update antivirus/anti-malware software          

Detection

• Be on the lookout for odd communication patterns in network traffic, such as connections to servers utilised by well-known command-and-control servers for ransomware.
• Use endpoint security tools or EDR tools to monitor endpoint behaviour for signs of file encryption activity or suspicious behaviour.
• Use anomaly detection techniques to spot unusual file access patterns or unlawful encryption activities.
• Users should be informed about ransomware symptoms and urged to report any odd actions or communications.
• Use file integrity monitoring tools to check for unauthorised modifications to critical system files.
• Follow security updates and alerts to be aware of any new ransomware threats.
• Run regular checks on machines for known ransomware signs using antivirus and anti-malware software. Then, review the logs for any peculiar or suspicious behaviour after turning on logging.
• Run frequent penetration testing and vulnerability assessments to identify and patch any security holes that ransomware might be able to exploit.

Indicators of Compromise (IOCs)

PowerShell Scripts:

Filename: amd - Copy.ps1, MD5 Hash: 861738dd15eb7fb50568f0e39a69e107

Filename: ipscan.ps1, MD5 Hash: 9f60dd752e7692a2f5c758de4eab3e6f

Filename: Run1.ps1, MD5 Hash: 09bc47d7bc5e40d40d9729cec5e39d73

Additional PowerShell Filenames:

[###].ps1, CME.ps1,  [#].ps1, Run1.ps1, mim.ps1, [##].ps1, psexec.ps1, Systems.ps1, System.ps1, etc..,

Batch Scripts:

Filename: CheckVuln.bat, MD5 Hash: f5ef5142f044b94ac5010fd883c09aa7

Filename: Create-share-RunAsAdmin.bat, MD5 Hash: 84e3b5fe3863d25bb72e25b10760e861

Filename: LPE-Exploit-RunAsUser.bat, MD5 Hash: 9f2309285e8a8471fce7330fcade8619

Filename: RCE-Exploit-RunAsUser.bat, MD5 Hash: 6c6c46bdac6713c94debbd454d34efd9

Filename: est.bat, MD5 Hash: e7ee8ea6fb7530d1d904cdb2d9745899

Filename: runav.bat, MD5 Hash: 815bb1b0c5f0f35f064c55a1b640fca5

Executables and DLLs:

Filename: http_x64.exe, MD5 Hash: 6c2874169fdfb30846fe7ffe34635bdb

Filename: spider.dll, MD5 Hash: 20855475d20d252dda21287264a6d860

Filename: spider_32.dll, MD5 Hash: 82db4c04f5dcda3bfcd75357adf98228

Filename: powershell.dll, MD5 Hash: fcf3a6eeb9f836315954dae03459716d

Filename: rpcdump.exe, MD5 Hash: 91625f7f5d590534949ebe08cc728380

Additional Observed Filenames:

test.exe, xxx.exe, Mim.exe, xxw.exe, crackmapexec.exe, Services.exe, plink.exe, Systems.exe, PsExec64.exe, etc..,

BlackCat Ransomware SHA256 Hashes:

731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161

f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb

731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161

80dd44226f60ba5403745ba9d18490eb8ca12dbc9be0a317dd2b692ec041da28

C2 IPs:

89.44.9.243    142.234.157.246    45.134.20.66  185.220.102.253    37.120.238.58    152.89.247.207     198.144.121.93    89.163.252.230    45.153.160.140   23.106.223.97    139.60.161.161   146.0.77.15    94.232.41.155

References

https://thehackernews.com/2023/06/improved-blackcat-ransomware-strikes.html 

www.ic3.gov

www.cisa.gov