▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Second, security recommendations and solutions
Tencent security experts advise users to take necessary measures to improve network security and avoid being subjected to ransomware virus attacks.

Business users
1) Close unnecessary ports as much as possible, such as 445, 135, 139, etc. White ports can be configured for ports 3389, 5900, etc. Only IP connections in the white list are allowed to log in;

2) Try to turn off unnecessary file sharing. If necessary, use ACL and strong password protection to limit access and disable anonymous access to shared folders;

3) Use strong passwords to avoid weak passwords, and Replace regularly. It is recommended to use high-strength and irregular passwords for server passwords, and it is mandatory to use different password management for each server;

4) Set corresponding controls on internal access to servers / workstations that do not require interconnection, to prevent servers that can be connected to external networks from being used as springboards to further attack Attack other servers;

5) Regularly back up important files and data (databases and other data), and keep at least one non-local backup;

6) It is recommended that enterprise end users handle cautious email attachments with caution. If not necessary, the Office macro code should be prohibited ;

7) the deployment of professional security software in the terminal / server, Web server may consider deploying in the cloud such as Tencent have professional security capabilities of cloud services platform. .

8) It is recommended to install the Tencent T-Sce terminal security management system

by
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑personal user

1) It is recommended to enable Tencent computer housekeeper, do not open strange mails at will, close Office to execute macro code;

2) Turn on the computer housekeeper's document guardian function, and use disk redundant space to automatically back up data files, even if an accident occurs, the data can be prepared.> those recommendations must applied for all members in undercode

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Analysis of encryption part
After the virus runs, first use ZLib to decompress a large amount of plain text string information to be used from the memory, which contains hard-coded RSA 2048 public key information

> Encrypted files add .Cov19 extension, FushenKingdee ransomware is active

🦑Then generate the local RSA 512 key pair information, export its RSA 512 Private Key (N, D), and splice and save it for later use.

> Then use the hard-coded RSA 2048 Public Key in the decompressed configuration to encrypt its RSA 512 Private Key, and the encryption result will be processed further.

🦑After the RSA 512 Private Key is encrypted, the following three processes are performed:

> Calculate the encrypted content length of RSA 512 Private Key: the following figure (Offset: 0x0, Size: 0x8);
Carry out CRC32 check on the encrypted content of RSA 512 Private Key and save its Hash: the following picture (Offset: 0x8, Size: 0x4);

> ZLib-Level 2 compression is performed on the encrypted content of its RSA 512 Private Key, the compression flag of 2 bytes before compression is removed, and the trailing 5 bytes are removed and saved (Offset: 0xC, Size: size after compression).

🦑Finally, the processed 3 parts of data are encoded using modified Base64:

The standard Base64-Table is:

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 + /

The virus modified Base64-Table is:

ABCDEFGHIJKLMNOPQRSTUVWXYZ + = 0123456789abcdefghijklmnopqrstuvwxyz

Before the virus encrypts the file, rdtsc will be used to generate a total of 0x30 (0x10 + 0x20 two parts) random key data for each file.

The generated size of 0x20 bytes will be used as the key first, and the file name will be encrypted using RC4.

Then, the RC4 encrypted file name data is non-standard Base64 encoded. The encoded string is the random file name after the file encryption. For example, the file name cef_100_percent.pak in the following figure will be renamed to iDQbLSy99iHpsRqiT2f7kwmrQhhHKOcKFaq5TnhlZgEX5gLATUo.cov

File encryption uses the AES-256 CBC mode. The previously generated 0x10 byte data will be used as the IV again, and the 0x20 byte random data will be used as the Key to encrypt the file content.