<— Back

Skulk Mailto Ransomware: An Interesting Anatomy of Cryptography, Eluding Anti-Ransomware Technologies

11:30 – 12:00(SGT) Friday 4 December, 2020

Even though Ransomware has been around since 1996, at present, it is the most sophisticated threat. The situation changed over the decade because of the techniques, tactics and procedures (TTPs) used by the malware authors have evolved a lot and are getting better day- by-day.

In February 2020, an Australian transportation company called Toll Group was hit by a notorious ransomware attack identified as Mailto. This infection reportedly spread to over 1000 servers and caused major disruption for the company and its clients. The same ransomware family was seen spreading through phishing emails, targeting people’s fear of COVID-19 pandemic. However, the most interesting trait of Mailto is the defence evasion of Anti-Ransomware technologies and implementation of strong cryptography algorithm.

This paper will focus on how Mailto ransomware evades the anti-ransomware technologies and the internals of encryption mechanism used by it. In this talk we will touch upon the following points

1. Mailto uses a special Process Hollowing technique which can bypass most of the security products, especially the sophisticated Anti-Ransomware detection technologies easily. The Windows API sequence used by this malware while performing this operation is completely different from the normal process hollowing, which we have seen over the years.
2. Demo: we will demonstrate the technique via short video clip and share the sequence of those APIs which will help the security vendors and products to monitor and block these types of evading techniques.
3. It also used famous cha-cha aka salsa20 for the symmetric encryption, but for asymmetric encryption, it has implemented the special Elliptic-curve Diffie- Hellman (EC-DH) i.e. curve25519-donna.
4. We will also explain the end to-end encryption process used by Mailto, which includes key identification, EC-DH algorithm identification, key-exchange, secret key agreement. We will touch base on the possibility of decryption mechanism as well.