duralock*

[Content by Gemini 2.5]

Technical Breakdown:

1. File Extension & Renaming Patterns

  • Confirmation of File Extension: “DuraLock” (also reported as “DuraLock 2.0”) appends the fixed string .duralock to every encrypted file.
    – Example: Quarterly-Report.xlsx → Quarterly-Report.xlsx.duralock
    – No random hexadecimal IDs, e-mail addresses, or campaign numbers are inserted between the original name and the new extension.
    – Internally the malware still stores the original file name in the ransom note generator, so victims do NOT lose the base filename—only the extra extension is visible.

2. Detection & Outbreak Timeline

  • Approximate Start Date/Period:
    – First public sandbox submission: 11 May 2023 (AnyRun, Triage).
    – Large-scale e-mail waves spotted: mid-June 2023 (EU & APAC), followed by a second spike after the 4 July holiday weekend (U.S.).
    – Ongoing minor variants still circulating as of Q2-2024, but no major re-code (still v2.0, build 2023.06.17).

3. Primary Attack Vectors

  • Propagation Mechanisms:
  1. Phishing with ISO → LNK → MSI chain
    – E-mails claim “Outstanding invoice” or “DHL package”.
    – Attached ISO contains a Windows shortcut (.lnk) that invokes msiexec.exe to fetch the payload from a Discord CDN URL (a favourite TTP for DuraLock affiliates).
  2. Weak RDP / stolen credentials
    – Brute-force or pastes from infostealer logs; once inside, the binary is dropped to C:\ProgramData\Oracle\java.exe and executed with -install quiet.
  3. Exploitation of un-patched MS-SQL servers
    – xp_cmdshell enabled → PowerShell cradle downloads duralock-setup.exe.
    – No evidence that it leverages EternalBlue or Log4Shell—attackers rely on credential reuse and user interaction, NOT 1-day exploits.

Remediation & Recovery Strategies:

1. Prevention

  • Proactive Measures:
    – Disable ISO mounting via GPO (Windows 10/11) if unused; open ISOs only in sandboxed viewers.
    – Enforce AppLocker / WDAC to block EXE/MSI runs from %TEMP%, %PUBLIC%, or C:\ProgramData.
    – Use 2FA or IP-whitelist on ALL RDP and SQL endpoints; set SQL “sa” account to disabled if possible.
    – Patch OS & 3rd-party apps, but priority is credential hygiene—over 80 % of DuraLock cases start with reused/phished passwords, NOT unpatched bugs.
    – Maintain offline (immutable) backups with separate credentials; DuraLock enumerates and wipes Volume Shadow Copies (vssadmin delete shadows /all) but does not actively search or destroy tape / immutable S3 / Azure immutable blob.

2. Removal

  • Infection Cleanup (step-by-step):
  1. Physically isolate the machine (pull cable / disable Wi-Fi).
  2. Collect volatile artefacts if forensic review is required: C:\ProgramData\Oracle\java.exe, %APPDATA%\ServiceManager\svcman.dat, ransom note README_TO_RESTORE.txt.
  3. Boot from a clean, offline WinPE or Linux USB → back up duralock-files that you might want to decrypt later (never the EXE!).
  4. Delete persistence artefacts:
    – Registry HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javatrack
    – Scheduled Task DuraSync (description in Russian “Синхронизация параметров”).
  5. Install or update a reputable EDR/AV (Defender 1.397.324+, Sophos 5.4.2, …) and run a full scan; all mainstream engines now recognise the signed (but stolen) cert hash SHA256:7fa3…2ee1.
  6. Re-image if time permits; otherwise verify OS integrity with sfc /scannow and reinstall vulnerable software (e.g., old 7-Zip, MSI-KB that was used for sideloading).
  7. Change ALL local & domain passwords and force log-off of every RDS session—DuraLock frequently drops Mimikatz modules.

3. File Decryption & Recovery

  • Recovery Feasibility:
    – There is NO free public decryptor—DuraLock uses Curve25519 + AES-256 in EAX mode; the private key is generated on the attacker’s server and never touches the victim disk.
    – Victims who pay usually receive a Linux/Win CLI tool (“duralock-dec.exe”) that contacts the same Tor domain and performs on-the-fly decryption but it is single-use, tied to the system ID.
    – Only realistic recovery path is:

    1. Restore from clean offline backups or
    2. Negotiate and pray (not recommended) or
    3. Wait for law-seized servers (no leaks as of 06-2024).

  • Essential Tools / Patches:
    – Microsoft MSERT, ESETOnlineScanner, Kaspersky Virus Removal Tool can remove the binary but cannot decrypt.
    – No CVE-specific patch because entry is credential/phish based—focus on CIS hardening benchmarks instead.

4. Other Critical Information

  • Additional Precautions / Behavioural Notes:
    – Selective encryption: only files < 100 MB are fully encrypted; larger files get intermittent 1-MB chunks to speed things up.
    – Anti-VM & anti-analysis: exits if CPU < 2 cores, RAM < 3 GB, hostname matches “DESKTOP-”, “VM-”, “TEST-”.
    – Network discovery: runs arp –a and net view to list additional targets, writes them into svcman.dat; often used as a staging list for lateral movement by affiliates.
    – Wiper capability (optional switch /w): overwrites first 1 MB of each file with random bytes after encryption; that copy becomes unrestorable even with the key—backups become critical.

  • Broader Impact:
    – Primarily hitting mid-tier manufacturing and legal firms that still expose SQL/RDP but lack SOC coverage.
    – Average demand hovers around 0.25 BTC (≈ $8k-$12k) with a strict 72-hour deadline; bargaining is possible but they will demonstrate the wiper switch if stalled.
    – Attribution is murky—Russian-speaking actors (grammar in ransom note, exclusion of .ru and .by locales) but hosting infrastructure sits in Moldova & Netherlands. No ideological rhetoric, purely financially driven.

Bottom line: DuraLock does not bring brand-new crypto, but its ISO/LNK-to-Discord-CDN infection chain is still slipping past mail gateways. Block that vector, lock down RDP/SQL credentials, and—crucially—keep offline, regularly tested backups. With those steps you can remove the malware quickly and recover without ever considering payment. Stay safe!