Speaker 1: Imagine, imagine, if you will, that you're holding a Russian
Speaker 1: nesting doll, you know, Matriasha. On the outside, it looks
Speaker 1: totally innocent, maybe a bit decorative painted wood, nothing scary
Speaker 1: at all. Yeah, but then you crack it open, expecting
Speaker 1: to find whatever the prize is inside, but instead you
Speaker 1: just find, well, another doll.
Speaker 2: It's identical, just a little smaller exactly.
Speaker 1: So you pry that one open, and there's another one,
Speaker 1: and then another. It isn't until you get three or
Speaker 1: four layers deep past all these decoys that you actually
Speaker 1: find the heart of the object.
Speaker 2: It's a classic analogy. Yeah, but in the context of
Speaker 2: what we're covering today, that final object isn't a prize.
Speaker 2: It's a weapon.
Speaker 1: Yeah, a repin Welcome to the deep dive. Today we're unpacking,
Speaker 1: and I mean literally unpacking, a piece of digital malware
Speaker 1: that absolutely terrorized the corporate world. We are talking about
Speaker 1: the Agrigor ransomware Gregor. Yeah, and we aren't just you know,
Speaker 1: skimming the headlines or reading a Wikipedia summary for you. Today.
Speaker 1: We're going straight to the source. We are walking looking
Speaker 1: through a highly technical forensic analysis report from the team
Speaker 1: at LIFARS.
Speaker 2: That's right, The report is titled Malware Analysis Unpacking of
Speaker 2: Eggregore Ransomware, and unpacking really is the operative word here.
Speaker 2: The life Fars team actually got their hands on a
Speaker 2: live sample of eggregor during a real incident response. They
Speaker 2: didn't just watch it run in a sandbox. They reverse
Speaker 2: engineered it. They took it apart, bite by bite, layer
Speaker 2: by layer, just to see what makes it tick.
Speaker 1: And what they found reads like a like a detective
Speaker 1: story where the villain just keeps changing disguises. This isn't
Speaker 1: your average I clicked a bad link and now my
Speaker 1: computer is slow kind of virus. This is a high stakes,
Speaker 1: targeted extortion tool designed to take down absolute giants. So
Speaker 1: let's just jump right in.
Speaker 2: Let's do it.
Speaker 1: The analysts get this file, they're ready to see the code.
Speaker 1: What is the very first thing they notice?
Speaker 2: Well, the first surprise is really the format itself. I mean,
Speaker 2: we are conditioned to think of viruses as executable files, right,
Speaker 2: like a dot x exactly, virus dot xity. But the
Speaker 2: sample they were covered was a DLL. Specifically, it was
Speaker 2: named klang dot dq l LA.
Speaker 1: Klang dot dll. Now I know just enough to be
Speaker 1: dangerous here, But klang is a legitimate compiler, right. It's
Speaker 1: a tool developers used to write and build code.
Speaker 2: It is, and that's exactly why it's such good camouflage.
Speaker 2: If assistant administrator is just scrolling through a massive list
Speaker 2: of files on a developer's machine, and they see Clang
Speaker 2: dot dl.
Speaker 1: DBIL, that's probably wouldn't even blink.
Speaker 2: It just looks like a standard helper library, right.
Speaker 1: It blends right in. But the analysts they didn't just
Speaker 1: look at the name. They used a tool called Kappa.
Speaker 2: Kappa.
Speaker 1: Yes, it's a tool that analyzes a file's capabilities, hence
Speaker 1: the name Kapa, rather than just relying on its signature.
Speaker 1: It looks at what the code is actively trying to do.
Speaker 1: And when they ran that Klang dot dl through Kappa,
Speaker 1: a massive red flag popped up almost immediately.
Speaker 2: What was the flag?
Speaker 1: The memory permissions. This entirely innocent looking DLL was requesting
Speaker 1: to allocate memory with RWX.
Speaker 2: Protections RWX So that's read write execute correct. Okay, let's
Speaker 2: unpack this a bit for everyone listening. Why is that
Speaker 2: specific combination the read, write, and execute such a massive
Speaker 2: warning sign for security teams Because in modern computing, and
Speaker 2: specifically in the Windows security architecture. You almost never want
Speaker 2: a program to be able to write data and execute
Speaker 2: code in the exact same place, right It's a fundamental
Speaker 2: security principle called wkret X or write x or execute.
Speaker 2: The idea is you either write data to a space
Speaker 2: or you run code from a space. You do not
Speaker 2: do both in the same spot because if you can
Speaker 2: do both, If you can do both, you can literally
Speaker 2: rewrite your own instructions while you are running. You can
Speaker 2: change your own code on the fly.
Speaker 1: Which is incredibly chaotic.
Speaker 2: It's chaotic and it's dangerous. Yeah, but malware loves it.
Speaker 2: If a program asks for read, write, and execute permission
Speaker 2: all in one chunk of memory, it almost always means
Speaker 2: it's preparing to unpack or decrypt a hidden payload and
Speaker 2: run it right there.
Speaker 1: It's basically clearing out a private workspace to build to bomb.
Speaker 2: Precisely that rwx slag confirmed the analyst that clig dot
Speaker 2: Deal wasn't the ransomware itself. It was a loader. Its
Speaker 2: only job is to smuggle the real malware past the
Speaker 2: security bouncers, set up a safe space in the computer's memory,
Speaker 2: and then launch the next stage.
Speaker 1: So we are at the very first layer of our
Speaker 1: mesting doll here. But before this loader even gets to
Speaker 1: do its job, the report mentioned something really weird. A
Speaker 1: kill switch, yes, but a very specific one.
Speaker 2: Oh, this part is fascinating. While the analysts were looking
Speaker 2: at the code strings inside the loader, they found a
Speaker 2: hard coded file path.
Speaker 1: What was it?
Speaker 2: It was looking for c drive, Python two seven DLLs,
Speaker 2: Underscore SPCs, ORPA dot pi.
Speaker 1: A Python script hiding inside an old Python two point
Speaker 1: seven folder.
Speaker 2: Very specific Python script. Yeah. The malware actually checks to
Speaker 2: see if this exact file exists on the computer it's currently.
Speaker 1: Infecting, and if it does.
Speaker 2: If it finds that file, nothing happens. The malware just
Speaker 2: stops completely. It refuses to run.
Speaker 1: Wait, so if I just happen to have a dummy
Speaker 1: file with that exact name on my computer, I'd be immune.
Speaker 2: To eggregor theoretically, yes, you would be.
Speaker 1: Why on earth would they build that in? Is it
Speaker 1: just a programming bug?
Speaker 2: No, it's very intentional. It's likely a safety mechanism for
Speaker 2: the attackers themselves.
Speaker 1: Yeah.
Speaker 2: To remember, these people are writing, compiling, and testing this
Speaker 2: highly destructive code on their own machines. Oh right, They
Speaker 2: do not want to accidentally double click their own creation
Speaker 2: and encrypt their own hard drives. That would be disastrous
Speaker 2: for them, so they place this dummy file on their
Speaker 2: own systems. It effectively acts as it do not detonate.
Speaker 1: Sign Wow, it's literally a vaccine for the creator.
Speaker 2: That is wild. It is, and it could also be
Speaker 2: a way to mark specific servers within a victim's network
Speaker 2: that they want to keep alive. What we mean, well,
Speaker 2: for example, if they're using a specific compromise server to
Speaker 2: exltrate gigabytes of data back to their headquarters, they don't
Speaker 2: want to encrypt that specific server mid heist. It would
Speaker 2: cut off their own cannet, So they dropped this Python
Speaker 2: file there to mark that machine as safe.
Speaker 1: That shows a level of operational discipline. I really wasn't expecting.
Speaker 1: It's not just random destruction. It's highly controlled exactly. Okay,
Speaker 1: So assuming that magic Python file isn't there, the loader
Speaker 1: proceeds and the report talks about a technique called reflective
Speaker 1: DLL loading. That sounds incredibly fancy. What does that actually
Speaker 1: mean for the person trying to stop the attack.
Speaker 2: It's a very advanced stealth technique. Traditionally, if you want
Speaker 2: to run a program, you save the file to the
Speaker 2: hard drive and you double click it, right, But antivirus
Speaker 2: software scans the hard drive constantly. It watches every single
Speaker 2: file that touches the disc. Reflective loading bypasses the hard
Speaker 2: drive entirely. The malware allocates that RWX memory we talked
Speaker 2: about earlier, and it manually writes the next stage of
Speaker 2: the attack directly into the RAM.
Speaker 1: So it's like a ghost. It never actually touches the floor.
Speaker 1: It just floats through the room.
Speaker 2: That's a great way to put it. It uses native
Speaker 2: Windows functions like virtual allock and virtual protect to trick
Speaker 2: the operating system into treating this blob of raw data
Speaker 2: in the RAM as a legitimate running program sneaky very
Speaker 2: and the analysts actually found proof of this happening in
Speaker 2: the code through a really nerdy detail involving indianness.
Speaker 1: Oh indian ness. I love that word. That's about byte ordering, right,
Speaker 1: like how computers read numbers.
Speaker 2: Yes, exactly. It refers to the order of bytes in memory.
Speaker 2: Some computer architectures read left to right, some read right
Speaker 2: to left. We call them big Indian and little Indian. Now,
Speaker 2: every single Windows executable file starts with a standard header
Speaker 2: marked by two letters M and Z MZ right for
Speaker 2: Marx s. Pokowski.
Speaker 1: You got it. But when the analysts looked at the
Speaker 1: code in memory, they didn't see MZ. They saw ZM
Speaker 1: dyslexic malware. No, just the indian ness the bytes were
Speaker 1: reversed in memory. Seeing ZM and EP instead of MZ
Speaker 1: and PE confirmed to the analysts that the code was
Speaker 1: actively parsing a Windows executable header right there in the memory.
Speaker 2: It was the smoking gun exactly.
Speaker 1: It proved that the ghost was taking a physical form,
Speaker 1: functionally speaking, inside the ram.
Speaker 2: Okay, so they successfully impact this first layer. They've got
Speaker 2: the ghost in a jar. They look inside fully expecting
Speaker 2: to find the ransomware, and what do they find instead?
Speaker 1: Layer two? Another DLL. This one was named payload one.
Speaker 2: Dot D another loader, another loader, but this one had
Speaker 2: a serious surprise waiting for them. When the analyst tried
Speaker 2: to run it in a sandbox, which is a safe
Speaker 2: isolated environment used for automated testing, it just wouldn't run.
Speaker 2: It just sat there.
Speaker 1: Playing dead in a way.
Speaker 2: Yeah, yeah, it had a unique lock on it. The
Speaker 2: analyst discovered that this second DLL checked the command line
Speaker 2: arguments used to launch it. It was actively looking for
Speaker 2: a specific parameter starting with dash.
Speaker 1: P dash P like for password exactly.
Speaker 2: The text following that dash pe wasn't just a random
Speaker 2: command flag, it was a cryptographic password. If you didn't
Speaker 2: type the correct password into the command line when launching
Speaker 2: the malware, the decryption would just fail. The payload would
Speaker 2: basically scramble itself in the GARB code. It wouldn't detonate.
Speaker 1: This totally blows my mind because we usually think of
Speaker 1: viruses as these automated things, you know, worms that crawl
Speaker 1: through the network on their own, infecting everything they touch automatically.
Speaker 1: But this dash pee thing implies a human touch.
Speaker 2: That is the crucial takeaway here. This implies a human
Speaker 2: operator on the keyboard. Greg wor isn't designed to just
Speaker 2: spread wildly like the flu. It is designed for a
Speaker 2: highly skilled hacker to break into a network, move around quietly,
Speaker 2: maybe steal some admin credentials, and then only when they're
Speaker 2: absolutely ready, they manually tack that password to detonate the
Speaker 2: ransomware on the target machines.
Speaker 1: It's a controlled demolish, it really is.
Speaker 2: And it's brilliant for evading security systems. Automated sandboxes don't
Speaker 2: know the password right, how could they exactly So if
Speaker 2: an anti virus system grabs this file and tries to
Speaker 2: run it in a test environment to see if it's malicious,
Speaker 2: it fails. It looks total harmless. It only becomes a
Speaker 2: weapon when the thief is standing right there holding the key.
Speaker 1: So how did the life team get the password to
Speaker 1: open it? Did they guess it? You know? Password one,
Speaker 1: two three?
Speaker 2: No, brute forcing high level encryption isn't really feasible in
Speaker 2: a timeframe like that. They got lucky. The report mentions
Speaker 2: they obtained the sample from colleagues who were responding to
Speaker 2: an actual live incident. They likely recovered the password from
Speaker 2: the command line logs or the memory dumps of a
Speaker 2: victim's machine where the attackers had already typed it in.
Speaker 1: Okay, so they have the password, they type dash P
Speaker 1: and the secret code. The second layer finally cracks open
Speaker 1: and inside finally we.
Speaker 2: Get to stage three payload two dot DLL. This is
Speaker 2: the beast. This is the actual Igregor ransomware.
Speaker 1: The thing that makes it. Admins want to cry.
Speaker 2: Yes, and it is heavy duty. The analysts looked at
Speaker 2: the encryption capabilities using the windcrypt library in Windows. They
Speaker 2: found a call to cryptgen key with a parameter size
Speaker 2: of two thousand and forty eight bits.
Speaker 1: Two forty eight bits, that's.
Speaker 2: RSA twenty forty eight And the report also notes they
Speaker 2: used the Chahaw stream cipher for the actual file encryption,
Speaker 2: which is incredibly fast, so they use both. Basically, they
Speaker 2: use the super secure RSA key to lock the super
Speaker 2: fast Chatchat.
Speaker 1: Keys, and in plain English for everyone listening.
Speaker 2: In plain English, this is military grade encryption. If you
Speaker 2: don't have the private key held by the attackers, you're
Speaker 2: not getting your data back. You can't just math your
Speaker 2: way out of this one.
Speaker 1: So once it launches, it just starts locking files. But
Speaker 1: the report pointed out something really interesting, almost rude, honestly,
Speaker 1: before it encrypts your files, it goes on a targeted
Speaker 1: killing spree. It has a hit list of programs it
Speaker 1: hunts down and terminates.
Speaker 2: Right And there's a very specific technical reason for this.
Speaker 2: In Windows, if a file is open and being actively
Speaker 2: used by a program, the operating system locks it.
Speaker 1: You can't modify it exactly.
Speaker 2: You can't change it, and you certainly can't encrypt it.
Speaker 2: So to ensure absolute maximum damage, the malware has to
Speaker 2: force close any program that might be holding your valuable
Speaker 2: data open.
Speaker 1: And the list of targets is pretty eclectic. I'm looking
Speaker 1: at the report details here. It kills sql server, Okay,
Speaker 1: that makes sense. That's databases. That's the crown jewels for
Speaker 1: a company, right. It kills Outlook and Thunderbird Okay, email archives,
Speaker 1: got it. But then it kills Steam.
Speaker 2: Yes, Steam and a bunch of other gaming related processes too.
Speaker 1: It feels so personal. You're hacking a multinational corporation. Why
Speaker 1: do you care about Steam?
Speaker 2: Well? Context is everything here. Remember that agregor was notoriously
Speaker 2: used to target major gaming studios.
Speaker 1: Ah right.
Speaker 2: If you're a game developer, your database isn't just financial spreadsheets,
Speaker 2: it's the three D game assets, the source code, the
Speaker 2: project files. All of those are opening your development tools.
Speaker 2: If the gregor wants to lock those mathsive assets, it
Speaker 2: has to kill the tools first.
Speaker 1: That makes total sense.
Speaker 2: So seeing Steam and various game engines on the kill
Speaker 2: list is a direct reflection of who they were hunting
Speaker 2: at the time.
Speaker 1: It's not just looking for word docs, it's looking for
Speaker 1: anything valuable to that specific victim. And speaking of killing tools,
Speaker 1: it doesn't just kill user apps, right, it goes after
Speaker 1: the cops too, it does.
Speaker 2: It explicitly hunts for forensic tools. The report list processes
Speaker 2: like prochmapron, process monitor, wire shark, specifically dump cap and process.
Speaker 1: Explorer, the exact tools an analyst would use.
Speaker 2: Yes, these are the tools a security analyst or an
Speaker 2: incident responder would launch to see what the malware is
Speaker 2: actually doing on the system.
Speaker 1: It's literally blinding the surveillance cameras while it robs.
Speaker 2: The bank exactly. It shows that the malware authors fully
Speaker 2: anticipate a fight. They know security teams will be watching,
Speaker 2: and they have automated camera measures ready to blind them.
Speaker 2: The second they try to look.
Speaker 1: It's actively fighting back.
Speaker 2: That is terrifying.
Speaker 1: So the malware runs, the apps closed, the files get locked.
Speaker 1: You're left with a digital brick. But the encryption is
Speaker 1: really only half the story with a gregorger, isn't it.
Speaker 1: The report goes into some os and open source intelligence
Speaker 1: about what happens next.
Speaker 2: This is the massive shift we've seen in the ransomware
Speaker 2: landscape over the last few years. We call it double extortion. Right.
Speaker 2: It's no longer just pay us to get your files back.
Speaker 2: It's pay us or we show everyone your deepest secrets.
Speaker 1: The report describes the ransom note directing victims to a
Speaker 1: dot onion website on the tour network.
Speaker 2: The dark web. Correct, and on this site, the attackers
Speaker 2: maintain what they boldly call a hall of shame.
Speaker 1: A hall of shame.
Speaker 2: Wow, it's a public dashboard of the companies they have
Speaker 2: successfully hacked. But it's worse than just a simple list.
Speaker 2: Next to each company name, they list the percentage of
Speaker 2: data they have disclosed or leaked so far.
Speaker 1: So it's basically a progress bar of humiliation exactly.
Speaker 2: It applies immense psychological pressure to the victim. Even if
Speaker 2: a company has perfect backups and says we don't need
Speaker 2: to pay you to unlock our files, we can restore
Speaker 2: them ourselves.
Speaker 1: The attackers still have leverage.
Speaker 2: The attackers say, fine, but do you want your customer database,
Speaker 2: your internal emails, and your proprietary trade secrets posted on
Speaker 2: the open Internet for your competitors to see.
Speaker 1: That is absolutely brutal. And the report mentors a specific
Speaker 1: section of the site called the wh Whole of the Month.
Speaker 2: Yes, whole of the month. They really have a twisted
Speaker 2: sense of humor, they really do. In the timeframe of
Speaker 2: this specific report, that section featured two very large gaming companies,
Speaker 2: But there was an incredibly chilling detail added to that entry.
Speaker 2: The attackers left of ps PostScript warning users to think
Speaker 2: about possible backdoors in those companies products.
Speaker 1: WHOA, let's unpack that for a second. They aren't just
Speaker 1: saying we stole the source code. They're heavily implying we
Speaker 1: might have modified the code before we left.
Speaker 2: Precisely, if you are a software company, that is an
Speaker 2: absolute death sentence for your reputation.
Speaker 1: Yeah, of course it is.
Speaker 2: If your users think your next game update or software
Speaker 2: patch might contain a virus because the source code was compromised.
Speaker 2: That destroys trust instantly. And the insidious part is whether
Speaker 2: the attackers actually planted backdoors or were just bluffing. The
Speaker 2: thread alone causes massive damage.
Speaker 1: It forces the company to basically audit every single line
Speaker 1: of code before they can release anything ever.
Speaker 2: Again, exactly, it's pure psychological warfare. It attacks the brand,
Speaker 2: not just the server infrastructure. And the report wrapped up
Speaker 2: by connecting Aggregor to another infamous ransomware.
Speaker 1: Family, right, yeah, the Maze ransomware. The analysts noted that
Speaker 1: Egregre shares a lot of similarities with Maize, particularly in
Speaker 1: the offustation techniques they used to hide the code.
Speaker 2: Maze was huge. They were the ones who essentially pioneered
Speaker 2: this entire double extortion tactic.
Speaker 1: Right and when the Maze group suddenly announced they were
Speaker 1: shutting down, Eggregor appeared almost immediately after.
Speaker 2: It strongly suggests a migration of talent the affiliates, the
Speaker 2: core developers that they didn't retire, They just rebranded and
Speaker 2: launched a new product.
Speaker 1: A software book date for criminals.
Speaker 2: It's a stark reminder that even when law enforcement or
Speaker 2: the industry defeats one ransomware group, the knowledge and the
Speaker 2: codebase just evolve into a new form.
Speaker 1: It's a hydra. You cut off one head and ag
Speaker 1: Grigor grows right in its.
Speaker 2: Place, exactly and usually the new head is smarter, faster,
Speaker 2: and much harder to kill.
Speaker 1: So let's bring this all back to the start. We
Speaker 1: began with a nesting ball. We had klang Deal, the
Speaker 1: camouflage loader allocating that highly suspicious RWX memory inside that payload.
Speaker 1: One dot Deal the lock box that needed a manual,
Speaker 1: human typed password to even open, and inside that payload,
Speaker 1: two dot Deal the rsa encrypted weapon that ruthlessly kills
Speaker 1: everything from SQL databases to steam.
Speaker 2: That is the technical journey. Yes, for you.
Speaker 1: Looking at this life fars report as an expert, what
Speaker 1: is the one thing that really sticks with you? What's
Speaker 1: the core takeaway you want people to remember?
Speaker 2: For me, it has to be that dash pee parameter,
Speaker 2: the password. Yeah, it represents a fundamental shift in how
Speaker 2: we have to think about enterprise defense. We aren't just
Speaker 2: fighting automated dumb scripts anymore. We are fighting intelligent human
Speaker 2: adversaries who are hands on keyboard.
Speaker 1: They're inside the house.
Speaker 2: They're navigating our networks, learning our specific systems, figuring out
Speaker 2: what we value most, and choosing the exact perfect moment
Speaker 2: to strike. They are manually entering a password to destroy
Speaker 2: your business. That means our defenses can't just be set
Speaker 2: and forget automated antivirus, right. We need human threadhunters who
Speaker 2: can spot that subtle behavior, the lateral movement, the quiet
Speaker 2: reconnaissance before that password ever gets typed.
Speaker 1: That is a very sobering thought. It's not a robot
Speaker 1: knocking at the door. It's a skilled burglar with a
Speaker 1: lock pick set who has been quietly living in your
Speaker 1: attic for.
Speaker 2: Two weeks and he already has the keys.
Speaker 1: And For me, the thing that sticks out is that
Speaker 1: image of the Hall of Shame. It reminds us that
Speaker 1: security isn't just an it problem about keeping the servers running.
Speaker 1: It's fundamentally about brand reputation. It's about trust.
Speaker 2: Absolutely.
Speaker 1: When you see Steam listed right next to seql server
Speaker 1: and a malware kill list, it's a reminder that everything
Speaker 1: in our networks is connected. Your fun Friday night gaming
Speaker 1: session and your crucial Monday morning financial reports are all
Speaker 1: living on the exact same, fragile digital ecosystem.
Speaker 2: Well said, the old network parameter is gone. Data is
Speaker 2: the ultimate asset, and trust is the only currency that matters.
Speaker 1: So here is a thought to leave you all with.
Speaker 1: In the old days, a burglar would break in steal
Speaker 1: your TV and maybe your jewelry. It was bad, but
Speaker 1: it was replaceable. A grigor doesn't just steal your diary,
Speaker 1: it threatens to read it out loud to the entire
Speaker 1: town square. In a world where data is our most
Speaker 1: valuable asset, how do you successfully defend against a thief
Speaker 1: whose most dangerous weapon isn't the encryption itself, but the humiliation?
Speaker 2: That is the exact question every CEO and board member
Speaker 2: needs be asking right now.
Speaker 1: Thanks for diving deep with us today. Check your processes,
Speaker 1: watch out for those stray Python scripts, and definitely stay
Speaker 1: safe out there, Stay secure,