Voltar 
Summary
While many organizations are patching the two recent Apache Log4j vulnerabilities (CVE-2021-44228 and CVE-2021-45046), attackers have been racing to exploit them to deliver malware, such as botnets, backdoors, and cryptominers.
Among the threats delivered using Log4Shell exploits, a new ransomware family was found by Bitdefender: Khonsari. For now, only a Windows version of the malware was found, first spotted on December 11th, where attackers were using the CVE-2021-44228 vulnerability to deliver the executable. Microsoft has also spotted a few cases where Khonsari was being launched from compromised Minecraft clients.
At this point, Khonsari appears to be an individual effort, not working in the popular Ransomware-as-a-Service (RaaS) model, used by REvil, LockBit, BlackMatter, and Hive.
Log4Shell
The first file involved in the attack was named “Main.class”, which is a Java downloader being delivered through Log4Shell.
The Java file is a simple downloader, and two days after Khonsari was first spotted, December 13th, the attackers changed the “Main.class” file to deliver another malware known as Orcus RAT.
Khonsari Ransomware
The ransomware was developed in .NET, where the attacker has manipulated the compiled time date stamp to 46 years in the future.
The malware developer has used minor obfuscation to hide some classes, functions, and variable names.
All the strings used by the ransomware are encrypted, using a quite simple rolling XOR algorithm, which can be represented by the following Python code:
As soon as it runs, Khonsari sends a network request to an external server.
