Hackers exploit Log4Shell to drop Khonsari Ransomware on Windows systems

Bitdefender researchers discovered that threat actors are attempting to exploit the Log4Shell flaw to deliver the new Khonsari ransomware on Windows machines. Bitdefender researchers discovered that threat actors are attempting to exploit the Log4Shell vulnerability (CVE-2021-44228) to deliver the new Khonsari ransomware on Windows machines. Experts warn that threat actors are attempting to exploit the Log4Shell flaw […]

December 14, 2021

Bitdefender researchers discovered that threat actors are attempting to exploit the Log4Shell flaw to deliver the new Khonsari ransomware on Windows machines.

Bitdefender researchers discovered that threat actors are attempting to exploit the Log4Shell vulnerability (CVE-2021-44228) to deliver the new Khonsari ransomware on Windows machines.

Experts warn that threat actors are attempting to exploit the Log4Shell flaw to deliver the new Khonsari ransomware on Windows machines.

The attackers exploited the Log4Shell remote code execution vulnerability to download a .NET binary from a remote server that encrypts the files on the target machine and adds the extension .khonsari to each file. The malware also drops a ransom note that requests the payment of the ransom in Bitcoin.

The ransom note is written in “C:\Users\\Desktop\HOW TO GET YOUR FILES BACK.TXT“, below is the text displayed to the victims:

“Your files have been encrypted and stolen by the Khonsari family.If you wish to decrypt , call (225) 287-1309 or email karenkhonsari@gmail.com.If you do not know how to buy btc, use a search engine to find exchanges.DO NOT MODIFY OR DELETE THIS FILE OR ANY ENCRYPTED FILES. IF YOU DO, YOUR FILES MAY BE UNRECOVERABLE.“

“On Sunday, 11th December, Bitdefender observed this payload as a malicious .NET binary file download from hxxp://3.145.115[.]94/zambo/groenhuyzen.exe. This is a new ransomware family, called Khonsari after the extension used on the encrypted files.” reads the analysis published by Bitdefender.

“Once executed, the malicious file will list all the drives and encrypt them entirely, except the C:\ drive. On the C:\ drive, Khonsari will encrypt only the following folders:”

C:\Users\<user>\Documents
C:\Users\<user>\Videos
C:\Users\<user>\Pictures
C:\Users\<user>\Downloads
C:\Users\<user>\Desktop

The Khonsari ransomware doesn’t encrypt files with the extensions .ini and .lnk, it uses the AES 128 CBC using PaddingMode.Zeros algorithm for encryption.as well as a remote access Trojan named Orcus by exploiting the recently disclosed critical Log4j vulnerability.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]