Full Report
All about Eldorado Ransomware and how its affiliates make their own samples for distribution.
Analysis Summary
# Tool/Technique: Eldorado Ransomware
## Overview
Eldorado is a Ransomware-as-a-Service (RaaS) operation that emerged in early 2024. It is developed in the Go programming language (Golang), allowing for cross-platform compatibility. The ransomware is primarily used to encrypt files on both Windows and Linux systems (including VMware ESXi hypervisors) to extort victims through a "double extortion" model.
## Technical Details
- **Type:** Malware family (Ransomware)
- **Platform:** Windows (32/64-bit), Linux (32/64-bit), VMware ESXi
- **Capabilities:** Multi-platform encryption, automated shadow copy deletion, network share discovery, and persistence via task scheduling.
- **First Seen:** March 2024
## MITRE ATT&CK Mapping
- **[TA0002 - Execution]**
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- **[TA0005 - Defense Evasion]**
- [T1070.004 - Indicator Removal: File Deletion] (Shadow Copy deletion)
- **[TA0007 - Discovery]**
- [T1135 - Network Share Discovery]
- [T1083 - File and Directory Discovery]
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact]
- [T1490 - Inhibit System Recovery]
## Functionality
### Core Capabilities
- **Cross-Platform Encryption:** Utilizes Golang to target both Windows and Linux architectures with specialized payloads for each.
- **Salsa20 Encryption:** Employs the Salsa20 stream cipher for high-speed file encryption.
- **RSA Public Key:** Uses RSA-2048 to encrypt the generated per-session keys, ensuring that decryption is only possible with the attacker's private key.
- **Command Line Customization:** Affiliates can configure parameters such as specific directories to encrypt/exclude, whether to encrypt network shares, and whether to delete shadow copies.
### Advanced Features
- **ESXi Integration:** Specific modules designed to shut down and encrypt virtual machine disks on VMware ESXi servers.
- **Self-Deletion:** The malware includes routines to remove its own binary after execution to hinder forensic analysis.
- **Automated Ransom Note Generation:** Affiliates can customize the ransom note via a builder web portal before generating the executable.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `1375e5d7f672bfd43ff7c3e4a145a96b75b66d8040a5c5f98838f6eb0ab9f27b` (32-bit Windows)
- `7f21d5c966f4fd1a042dad5051dfd9d4e7dfed58ca7b78596012f3f122ae66dd` (64-bit Windows)
- `cb0b9e509a0f16eb864277cd76c4dcaa5016a356dd62c04dff8f8d96736174a7` (64-bit Windows)
- `b2266ee3c678091874efc3877e1800a500d47582e9d35225c44ad379f12c70de` (32-bit Linux)
- `dc4092a476c29b855a9e5d7211f7272f04f7b4fca22c8ce4c5e4a01f22258c33` (64-bit Linux)
- **File Names:** `c.exe`, `eldorado.exe`, `encryptor.linux`
- **Network Indicators:**
- `173.44.141[.]152`
- **Behavioral Indicators:**
- Execution of `vssadmin.exe delete shadows /all /quiet`
- Rapid file renaming with a specific extension (e.g., `.00.eldorado`)
## Associated Threat Actors
- **Eldorado RaaS Affiliates:** Currently operated by a centralized group that recruits affiliates to carry out the initial breach and deployment.
## Detection Methods
- **Signature-based:** Traditional AV/EDR signatures targeting known Golang ransomware patterns and the specific Salsa20 implementation used by Eldorado.
- **Behavioral detection:** Monitoring for the mass modification of files followed by the deletion of Volume Shadow Copies.
- **YARA Rules:** Use rules focusing on Golang string patterns and the unique ransom note templates associated with this family.
## Mitigation Strategies
- **Offline Backups:** Maintain immutable, off-site backups to ensure recovery without paying the ransom.
- **Access Control:** Implement the Principle of Least Privilege (PoLP) and utilize Multi-Factor Authentication (MFA) to prevent lateral movement.
- **Patch Management:** Prioritize patching of public-facing applications and VPNs to prevent initial entry.
- **Network Segmentation:** Isolate critical assets and ESXi management interfaces from general user segments.
## Related Tools/Techniques
- **LockBit:** Similar RaaS business model and focus on ESXi environments.
- **Babuk:** Shared focus on Linux/ESXi targets, though Eldorado is technically distinct.
- **Golang-based Malware:** Similar to other recent ransomware families (like Hive or Agenda) that transitioned to Go for easier cross-platform development.