Pierluigi Paganini July 12, 2019

Exclusive – Malware researchers at Yoroi-Cybaze ZLab have released a free decryptor tool for the Loocipher Ransomware.

Ransomware continues to be an easy way to monetize the criminal efforts and for this reason new malware appear in the threat landscape.

Loocipher is a new threat that is rapidly spreading, its functionalities are pretty straight forward as effective, common to many other ransomware families.

Recently experts at Yoroi-Cybaze ZLab published a detailed analysis of the Loocipher ransomware, below the key findings of the analysis:

• The ransomware spreads using weaponized Word document.
• The Command and Control is hosted on the TOR Network, at the following onion address “hxxp://hcwyo5rfapkytajg[.]onion” .
• The attackers leverage several Tor2Web proxy services to easily allow the access to the Tor C2.
• The binary can work both as cryptor and decryptor.
• The C2 dynamically generates a different Bitcoin address for each infection.

As other ransomware families, LooCipher encrypts all the user files having the following extensions:

According to Fortinet, the encryption algorithm used by the LooCipher ransomware is AES-128 ECB with a 16-bytes key. The key is generated in a random way, starting from an array of pre-defined characters:

Since AES is a symmetric-key algorithm, retrieving the key it is possible to restore all encrypted files. The key will be sent to the C2 over HTTP as GET parameter (“k=”), but obviously it is obfuscated.

Experts pointed out an interesting details revealed by Fortinet researchers, the obfuscation method is very trivial. It consists in a simple replacing of each key characters with a pre-defined double-digit number, belonging to the following set:

So, once retrieved the obfuscated key it is possible to reconstruct the original key and decrypt all files.

The crucial point is to extract the obfuscated key. As shown by Fortinet, this can be done in two ways:

• Intercepting the network traffic, when the malware sends the key to the C2. This method could be difficult because the key is sent only once, and it is necessary to capture the exact network traffic containing this request.
• Exploring the memory map of LooCipher process after the completion of the encryption. The entire path (including the key) used to contact the C2 is still stored in the process memory location. This could be complex to not experienced users.

The expert of Cybaze-Yoroi ZLab released an automatic tool that is able to extract the secret key and proceed with the decryption of all files previously encrypted by the LooCipher ransomware. The tool requires the LooCipher process to be active. So, it does not work if the process gets killed or the PC went restarted, because the process memory containing the key is reset.

Experts published a post on the Yoroi blog:

https://blog.yoroi.company/announcement/loocipher-ransomware-decryptor-released-for-free/

The tool is available on Github at the following URL:

https://github.com/ZLab-Cybaze-Yoroi/LooCipher_Decryption_Tool

enjoy it