ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9

General

Target

ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9
Size

10.4MB
Sample

220521-a42xdsecer
MD5

51fc6af2fca0debc1b2a9cd657c51f08
SHA1

717598e0090355ea6879466379672318f32f0338
SHA256

ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9
SHA512

b98935bfa8b76c503e41cd1040c95dde20b6cbd15ed1c90656725098c2d48afcf7ba65d19e6fe6287622dec9b5bb39c2a9e6dd2c0fab8136ad3dbc1874d122a4

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\OpenVPN\doc\openvpn.8.html

Ransom Note

Content-type: text/html; charset=UTF-8 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <HTML><HEAD><TITLE>Man page of openvpn</TITLE> </HEAD><BODY> <H1>openvpn</H1> Section: Maintenance Commands (8) Updated: 28 February 2018 <A HREF="#index">Index</A> <A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR> <A NAME="lbAB"> </A> <H2>NAME</H2> openvpn - secure IP tunnel daemon. <A NAME="lbAC"> </A> <H2>SYNOPSIS</H2> openvpn [ options ... ] <A NAME="lbAD"> </A> <H2>INTRODUCTION</H2> OpenVPN is an open source VPN daemon by James Yonan. Because OpenVPN tries to be a universal VPN tool offering a great deal of flexibility, there are a lot of options on this manual page. If you're new to OpenVPN, you might want to skip ahead to the examples section where you will see how to construct simple VPNs on the command line without even needing a configuration file. Also note that there's more documentation and examples on the OpenVPN web site: <A HREF="http://openvpn.net/">http://openvpn.net/</A> And if you would like to see a shorter version of this manual, see the openvpn usage message which can be obtained by running openvpn without any parameters. <A NAME="lbAE"> </A> <H2>DESCRIPTION</H2> OpenVPN is a robust and highly flexible VPN daemon. OpenVPN supports SSL/TLS security, ethernet bridging, TCP or UDP tunnel transport through proxies or NAT, support for dynamic IP addresses and DHCP, scalability to hundreds or thousands of users, and portability to most major OS platforms. OpenVPN is tightly bound to the OpenSSL library, and derives much of its crypto capabilities from it. OpenVPN supports conventional encryption using a pre-shared secret key (Static Key mode) or public key security (SSL/TLS mode) using client & server certificates. OpenVPN also supports non-encrypted TCP/UDP tunnels. OpenVPN is designed to work with the TUN/TAP virtual networking interface that exists on most platforms. Overall, OpenVPN aims to offer many of the key features of IPSec but with a relatively lightweight footprint. <A NAME="lbAF"> </A> <H2>OPTIONS</H2> OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix can be removed when an option is placed in a configuration file. <DL COMPACT> <DT>--help <DD> Show options. <DT>--config file <DD> Load additional config options from file where each line corresponds to one command line option, but with the leading '--' removed. If --config file is the only option to the openvpn command, the --config can be removed, and the command can be given as openvpn file Note that configuration files can be nested to a reasonable depth. Double quotation or single quotation characters ("", '') can be used to enclose single parameters containing whitespace, and "#" or ";" characters in the first column can be used to denote comments. Note that OpenVPN 2.0 and higher performs backslash-based shell escaping for characters not in single quotations, so the following mappings should be observed: <PRE> \\ Maps to a single backslash character (\). \" Pass a literal doublequote character ("), don't interpret it as enclosing a parameter. \[SPACE] Pass a literal space or tab character, don't interpret it as a parameter delimiter. </PRE> For example on Windows, use double backslashes to represent pathnames: <PRE> secret "c:\\OpenVPN\\secret.key" </PRE> For examples of configuration files, see <A HREF="http://openvpn.net/examples.html">http://openvpn.net/examples.html</A> Here is an example configuration file: <PRE> # # Sample OpenVPN configuration file for # using a pre-shared static key. # # '#' or ';' may be used to delimit comments. # Use a dynamic tun device. dev tun # Our remote peer remote mypeer.mydomain # 10.1.0.1 is our local VPN endpoint # 10.1.0.2 is our remote VPN endpoint ifconfig 10.1.0.1 10.1.0.2 # Our pre-shared static key secret static.key </PRE> </DL> <A NAME="lbAG"> </A> <H3>Tunnel Options:</H3> <DL COMPACT> <DT>--mode m <DD> Set OpenVPN major mode. By default, OpenVPN runs in point-to-point mode ("p2p"). OpenVPN 2.0 introduces a new mode ("server") which implements a multi-client server capability. <DT>--local host <DD> Local host name or IP address for bind. If specified, OpenVPN will bind to this address only. If unspecified, OpenVPN will bind to all interfaces. <DT>--remote host [port] [proto] <DD> Remote host name or IP address. On the client, multiple --remote options may be specified for redundancy, each referring to a different OpenVPN server. Specifying multiple --remote options for this purpose is a special case of the more general connection-profile feature. See the <connection> documentation below. The OpenVPN client will try to connect to a server at host:port in the order specified by the list of --remote options. proto indicates the protocol to use when connecting with the remote, and may be "tcp" or "udp". For forcing IPv4 or IPv6 connection suffix tcp or udp with 4/6 like udp4/udp6/tcp4/tcp6. The client will move on to the next host in the list, in the event of connection failure. Note that at any given time, the OpenVPN client will at most be connected to one server. Note that since UDP is connectionless, connection failure is defined by the --ping and --ping-restart options. Note the following corner case: If you use multiple --remote options, AND you are dropping root privileges on the client with --user and/or --group, AND the client is running a non-Windows OS, if the client needs to switch to a different server, and that server pushes back different TUN/TAP or route settings, the client may lack the necessary privileges to close and reopen the TUN/TAP interface. This could cause the client to exit with a fatal error. If --remote is unspecified, OpenVPN will listen for packets from any IP address, but will not act on those packets unless they pass all authentication tests. This requirement for authentication is binding on all potential peers, even those from known and supposedly trusted IP addresses (it is very easy to forge a source IP address on a UDP packet). When used in TCP mode, --remote will act as a filter, rejecting connections from any host which does not match host. If host is a DNS name which resolves to multiple IP addresses, OpenVPN will try them in the order that the system getaddrinfo() presents them, so priorization and DNS randomization is done by the system library. Unless an IP version is forced by the protocol specification (4/6 suffix), OpenVPN will try both IPv4 and IPv6 addresses, in the order getaddrinfo() returns them. <DT>--remote-random-hostname <DD> Prepend a random string (6 bytes, 12 hex characters) to hostname to prevent DNS caching. For example, "foo.bar.gov" would be modified to "<random-chars>.foo.bar.gov". <DT><connection> <DD> Define a client connection profile. Client connection profiles are groups of OpenVPN options that describe how to connect to a given OpenVPN server. Client connection profiles are specified within an OpenVPN configuration file, and each profile is bracketed by <connection> and </connection>. An OpenVPN client will try each connection profile sequentially until it achieves a successful connection. --remote-random can be used to initially "scramble" the connection list. Here is an example of connection profile usage: <PRE> client dev tun <connection> remote 198.19.34.56 1194 udp </connection> <connection> remote 198.19.34.56 443 tcp </connection> <connection> remote 198.19.34.56 443 tcp http-proxy 192.168.0.8 8080 </connection> <connection> remote 198.19.36.99 443 tcp http-proxy 192.168.0.8 8080 </connection> persist-key persist-tun pkcs12 client.p12 remote-cert-tls server verb 3 </PRE> First we try to connect to a server at 198.19.34.56:1194 using UDP. If that fails, we then try to connect to 198.19.34.56:443 using TCP. If that also fails, then try connecting through an HTTP proxy at 192.168.0.8:8080 to 198.19.34.56:443 using TCP. Finally, try to connect through the same proxy to a server at 198.19.36.99:443 using TCP. The following OpenVPN options may be used inside of a <connection> block: bind, connect-retry, connect-retry-max, connect-timeout, explicit-exit-notify, float, fragment, http-proxy, http-proxy-option, link-mtu, local, lport, mssfix, mtu-disc, nobind, port, proto, remote, rport, socks-proxy, tun-mtu and tun-mtu-extra. A defaulting mechanism exists for specifying options to apply to all <connection> profiles. If any of the above options (with the exception of remote ) appear outside of a <connection> block, but in a configuration file which has one or more <connection> blocks, the option setting will be used as a default for <connection> blocks which follow it in the configuration file. For example, suppose the nobind option were placed in the sample configuration file above, near the top of the file, before the first <connection> block. The effect would be as if nobind were declared in all <connection> blocks below it. <DT>--proto-force p <DD> When iterating through connection profiles, only consider profiles using protocol p ('tcp'|'udp'). <DT>--remote-random <DD> When multiple --remote address/ports are specified, or if connection profiles are being used, initially randomize the order of the list as a kind of basic load-balancing measure. <DT>--proto p <DD> Use protocol p for communicating with remote host. p can be udp, tcp-client, or tcp-server. The default protocol is udp when --proto is not specified. For UDP operation, --proto udp should be specified on both peers. For TCP operation, one peer must use --proto tcp-server and the other must use --proto tcp-client. A peer started with tcp-server will wait indefinitely for an incoming connection. A peer started with tcp-client will attempt to connect, and if that fails, will sleep for 5 seconds (adjustable via the --connect-retry option) and try again infinite or up to N retries (adjustable via the --connect-retry-max option). Both TCP client and server will simulate a SIGUSR1 restart signal if either side resets the connection. OpenVPN is designed to operate optimally over UDP, but TCP capability is provided for situations where UDP cannot be used. In comparison with UDP, TCP will usually be somewhat less efficient and less robust when used over unreliable or congested networks. This article outlines some of problems with tunneling IP over TCP: <A HREF="http://sites.inka.de/sites/bigred/devel/tcp-tcp.html">http://sites.inka.de/sites/bigred/devel/tcp-tcp.html</A> There are certain cases, however, where using TCP may be advantageous from a security and robustness perspective, such as tunneling non-IP or application-level UDP protocols, or tunneling protocols which don't possess a built-in reliability layer. <DT>--connect-retry n [max] <DD> Wait n seconds between connection attempts (default=5). Repeated reconnection attempts are slowed down after 5 retries per remote by doubling the wait time after each unsuccessful attempt. The optional argument max specifies the maximum value of wait time in seconds at which it gets capped (default=300). <DT>--connect-retry-max n <DD> n specifies the number of times each --remote or <connection> entry is tried. Specifying n as one would try each entry exactly once. A successful connection resets the counter. (default=unlimited). <DT>--show-proxy-settings <DD> Show sensed HTTP or SOCKS proxy settings. Currently, only Windows clients support this option. <DT>--http-proxy server port [authfile|'auto'|'auto-nct'] [auth-method] <DD> Connect to remote host through an HTTP proxy at address server and port port. If HTTP Proxy-Authenticate is required, authfile is a file containing a username and password on 2 lines, or "stdin" to prompt from console. Its content can also be specified in the config file with the --http-proxy-user-pass option. (See section on inline files) auth-method should be one of "none", "basic", or "ntlm". HTTP Digest authentication is supported as well, but only via the auto or auto-nct flags (below). The auto flag causes OpenVPN to automatically determine the auth-method and query stdin or the management interface for username/password credentials, if required. This flag exists on OpenVPN 2.1 or higher. The auto-nct flag (no clear-text auth) instructs OpenVPN to automatically determine the authentication method, but to reject weak authentication protocols such as HTTP Basic Authentication. <DT>--http-proxy-option type [parm] <DD> Set extended HTTP proxy options. Repeat to set multiple options. VERSION version -- Set HTTP version number to version (default=1.0). AGENT user-agent -- Set HTTP "User-Agent" string to user-agent. CUSTOM-HEADER name content -- Adds the custom Header with name as name and content as the content of the custom HTTP header. <DT>--socks-proxy server [port] [authfile] <DD> Connect to remote host through a Socks5 proxy at address server and port port (default=1080). authfile (optional) is a file containing a username and password on 2 lines, or "stdin" to prompt from console. <DT>--resolv-retry n <DD> If hostname resolve fails for --remote, retry resolve for n seconds before failing. Set n to "infinite" to retry indefinitely. By default, --resolv-retry infinite is enabled. You can disable by setting n=0. <DT>--float <DD> Allow remote peer to change its IP address and/or port number, such as due to DHCP (this is the default if --remote is not used). --float when specified with --remote allows an OpenVPN session to initially connect to a peer at a known address, however if packets arrive from a new address and pass all authentication tests, the new address will take control of the session. This is useful when you are connecting to a peer which holds a dynamic address such as a dial-in user or DHCP client. Essentially, --float tells OpenVPN to accept authenticated packets from any address, not only the address which was specified in the --remote option. <DT>--ipchange cmd <DD> Run command cmd when our remote ip-address is initially authenticated or changes. cmd consists of a path to script (or executable program), optionally followed by arguments. The path and arguments may be single- or double-quoted and/or escaped using a backslash, and should be separated by one or more spaces. When cmd is executed two arguments are appended after any arguments specified in cmd , as follows: cmd ip_address port_number Don't use --ipchange in --mode server mode. Use a --client-connect script instead. See

Emails

HREF="mailto:[email protected]">[email protected]</A>

HREF="mailto:[email protected]">[email protected]</A>

HREF="mailto:[email protected]">[email protected]</A>&gt

URLs

http-proxy

Targets

- Target
  
  ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9
- Size
  
  10.4MB
- MD5
  
  51fc6af2fca0debc1b2a9cd657c51f08
- SHA1
  
  717598e0090355ea6879466379672318f32f0338
- SHA256
  
  ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9
- SHA512
  
  b98935bfa8b76c503e41cd1040c95dde20b6cbd15ed1c90656725098c2d48afcf7ba65d19e6fe6287622dec9b5bb39c2a9e6dd2c0fab8136ad3dbc1874d122a4
Score

10^/10

ransomware discovery persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2