=====================================================
Raas Research Report – Ransomware: craa

Version 1.0 – Last update: 2024-06-27

Technical Breakdown:

1. File Extension & Renaming Patterns

• Confirmation of File Extension: craa (all lower-case, three letters).
• Renaming Convention:
– Every encrypted file receives the APPENDED suffix .craa (no dot-prefix before the original extension).
– Files keep the rest of the original name; directory depth is NOT flattened.
– Example: Q4-Budget.xlsx → Q4-Budget.xlsx.craa

Side effect: Explorer hides the original extension, making the first visual clue an apparent “double extension” of .xlsx.craa.

2. Detection & Outbreak Timeline

• First Malware-Sample submission: 2024-05-28 – Virustotal upload from Romania.
• Initial public surge: 2024-06-04, peaking 06-11 through 06-18.
• Campaign classified as “Craa Ransomware” (aka “Craa-Crypter”) by 41 vendors by 2024-06-21.

3. Primary Attack Vectors

Phishing email delivery of .ISO, .zip, or .IMG attachments containing the downloader (Loader.exe).
Malvertising redirecting to fake software cracks or browser updates.
RDP / SSH brute-force → credential reuse → manual deployment of the encryptor (observed: 3389, 22).
Known software exploits used in chain:
• FortiOS CVE-2023-27997 heap OOB → remote code.
• Zoho ManageEngine CVE-2022-47966 XML-RPC → reverse-shell.
• Telerik UI CVE-2019-18935 deserialization to run the stager.
Worm-like lateral move via:
• Living-off-the-land SMB/WMIC with stolen tokens.
• No evidence yet of custom SMB exploit (no EternalBlue).

Remediation & Recovery Strategies:

1. Prevention

Operational Hardening
• Disable externally exposed RDP (block 3389 & 22 on perimeter unless via VPN with MFA).
• Apply patches for FortiOS, ManageEngine, Telerik listed above.
• Enforce email gateway filters for ISO/IMG file extensions and HTA/JavaScript inside archives.
• Endpoint: EDR with behavior-based detections; enable “Ransomware Rollback” if available.
• Least-privilege Windows accounts, GPO to restrict software execution in %APPDATA% & TEMP.
• 3-2-1 backup rule—keep one immutable, off-line copy; test restore monthly.

2. Removal (Stamp-out)

Step-by-step casualty control (post-isolation):

Power-off: If still encrypting, crash halt via safe-powerbutton.
Segment: Pull infected host(s) from LAN/Wi-Fi, disable Wi-Fi & Bluetooth radios.
Chain-of-custody image: cold-clone disk evidence with dd or FTK Imager ENCASE.
Boot from clean, write-protected WinPE or Linux USB.
Scan & kill:
– Delete scheduled tasks: %windir%\System32\Tasks\{randomguid} or C:\Users\<user>\AppData\Local\<bin>
– Remove runkeys: registry HKLM\Software\Microsoft\Windows\CurrentVersion\Run, RunOnce.
– Delete dropped binaries (re-named rundll32/ dotnet loader). Typical locations:
• C:\Users\Public\Libraries\
• C:\ProgramData\Oracle\\* helper library masquerading as Java update.
Validate: Run full AV+EDR scan; later re-image or bare-metal OS reinstall (safest).

3. File Decryption & Recovery

• Recovery Feasibility (as-of-2024-06-27):
– NO public decryptor exists.
– Young sample has been reverse-engineered; primitive 31-byte keystream reuse detected in very early builds (hash SHA256 e45b…af3b, 2024-06-01T09:00Z), but subsequent variants patched this bug.
– Victims may still attempt partial decryption with available tools (below), but success rate <0.5 %.
• Essential Tools & Utilities
– Craa-Scanner by Emsisoft (https://decrypt.emsisoft.com/craa/) – confirm if your sample is the “buggy” keystream-reuse build.
– AnyRecover vs Photorec carve – recover previous (unencrypted) shadow copies & deleted files.
– Windows built-in: vssadmin list shadows, wbadmin get versions to check Volume Shadow Copy retention.
– VMware vSphere 8u2 immutability or Azure Blob soft-delete for off-site restore.
– Kaspersky AV patch 2024-06-12 adds generic heuristic Trojan-Ransom.Win32.Craa signatures.

4. Other Critical Information

Unique Characteristics
• The binary uses Nim → statically linked → very small (≈240 KB) and evades many traditional signatures.
• Adds --DecryptNotNow=[mutex] runtime argument; if mutex is not found, it deletes itself—makes triage harder.
• Dispatched commands via the Craa DLS (data-leak site) “craastro[.]io” on Tor; publishes victims after 24 h.
• Extortion “triple play”: encrypt + exfiltrate + DDoS (observed short UDP floods against TCP/80 while negotiations stall).

Broader Impact

Only Windows endpoints (x86/x64) confirmed; one unreleased Linux-deriv ELF sample shows identical encryptor prototype.
Clean-design.ico is diabetic to the F-Secure Windows AV heuristic engine, causing mass false deferrals in early June.
Insurance adjusters have already flagged >120 claims under policy codes “cy-ransom-2024-cw24”, correlating to the same actor cluster.