<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="x_elementToProof" style="margin:0px;font-size:12pt;background-color:rgb(255, 255, 255)"><span class="x_x_elementToProof" style="margin:0px;background-color:rgb(255, 255, 255)"><span class="x_x_x_elementToProof" style="margin:0px;background-color:rgb(255, 255, 255)"><span class="x_x_x_x_elementToProof" style="margin:0px;background-color:rgb(255, 255, 255)"><span style="margin:0px;background-color:rgb(255, 255, 255)"><span style="margin:0px;background-color:rgb(255, 255, 255)"><span style="margin:0px;font-size:14.67px">Hello,</span></span></span></span></span></span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<div class="x_elementToProof" style="margin:0px;font-size:12pt;background-color:rgb(255, 255, 255)">
<div class="x_x_elementToProof" style="margin:0px;background-color:rgb(255, 255, 255)">
<div class="x_x_x_elementToProof" style="margin:0px;background-color:rgb(255, 255, 255)">
<div class="x_x_x_x_elementToProof" style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0)"><span style="margin:0px;font-size:15px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255);display:inline !important"></span>
<div style="margin:0px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:15px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0)">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0)"><span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important"></span>
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px">
<div style="margin:0px;color:rgb(0, 0, 0) !important;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important"><span style="margin:0px;background-color:white !important"></span>
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important"><span style="margin:0px;background-color:white !important"></span>
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important"><span style="margin:0px;background-color:white !important"></span>
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:14.67px;background-color:white !important">I hope everyone is doing well!</div>
<div style="margin:0px;font-size:14.67px;background-color:white !important"><br>
</div>
<div style="margin:0px;font-size:14.67px;background-color:white !important">Below is the entry for today.</div>
<div style="margin:0px;font-size:14.67px;background-color:white !important"><br>
</div>
<div style="margin:0px;font-size:14.67px;background-color:white !important">04/19/2022 - Diary entry #494<br>
</div>
<blockquote style="font-size:14.67px;margin-top:0px;margin-bottom:0px;background-color:white !important">
<div style="margin:0px"><br>
</div>
<div style="margin:0px"></div>
<div style="margin:0px"></div>
In our Daily Diary #402, we covered Yanluowang Ransomware, a threat discovered in late 2021 that targeted large enterprises in the U.S., Brazil, Turkey and other countries. Yanluowang, named after the Chinese deity Yanluo Wang, was used only on targeted attacks,
having a low number of infections.
<div><br>
</div>
<div>To encrypt the files, Yanluowang uses Sosemanuk, an unpatented stream cipher (symmetric) described in 2008. After using Sosemanuk, the key is encrypted with a RSA-1024 (asymmetric) embedded in the malware, and the encrypted bytes are appended in the end
of each encrypted file. That means the RSA private key, in possession of the attackers, has the capability of decrypting the Sosemanuk key, which is used to decrypt the original file contents. More than that, if the Sosemanuk key is discovered, there is no
need to get the private key from the attackers at all.</div>
<div><br>
</div>
<div>This week a new decryptor for Yanluowang was released as part of RannohDecryptor, one of the Decryptors listed in the NoMoreRansom project. To work with the tool, the user needs to have the backup of a file that was encrypted with at least 1024 bytes,
allowing it to recover any file up to 3GB large. In case the encrypted file is larger than 3GB, then the backup of another big file is needed. By analyzing the original and encrypted file pair, RannohDecryptor is capable of deducting the <span style="background-color:rgb(255, 255, 255);display:inline !important">Sosemanuk</span>
key used on other files, and decrypt the remaining on the system.</div>
<div><br>
</div>
Creating decryptors through Reverse Engineering is a hard task that requires advanced knowledge of cryptography and malware behavior, but it can help organizations and individuals that have been affected in the past - and didn't pay the ransom - to recover
important files. In the double-extortion model, more popular among new threats nowadays, having a decryptor only means you can recover the files, but the threat to have them published online is still real. Therefore, companies of all sizes should invest in
prevention and not rely on the publication of free decryptors.
<div style="margin:0px"></div>
<span style="margin:0px"></span>
<div style="margin:0px"><br>
</div>
<div style="margin:0px"></div>
<div style="margin:0px"></div>
<div style="margin:0px"></div>
</blockquote>
<span style="margin:0px;font-size:14.67px;background-color:white !important">Kind Regards,</span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div></div>
<div></div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-family:"Times New Roman"; font-size:medium; text-align:start">
<tbody>
<tr>
<td width="180" align="left" style="width:180px">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/"><img alt="" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/"><img width="18" height="18" alt="" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity"><img width="20" height="18" alt="" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ"><img width="26" height="18" alt="" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p> </p>
</td>
<td width="350" colspan="2" rowspan="2" style="width:350px">
<p style="font-family:Arial,Helvetica,sans-serif; font-size:13px; color:rgb(12,12,12)">
<strong>Felipe Duarte Domingues</strong><br>
Security Researcher<br>
<strong>Appgate</strong></p>
<p style="font-family:Arial,Helvetica,sans-serif; font-size:13px; color:rgb(12,12,12)">
E:<span> </span><font color="#228ebe"><a href="mailto:felipe.duarte@appgate.com" title="mailto:felipe.duarte@appgate.com">felipe.duarte@appgate.com</a></font><br>
O: <span style="background-color:rgb(255,255,255); display:inline!important">+55 19 98840 2509</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>