This is really a hands on tutorial on how to download the hidden tier ransomware.
Edit it and then executed on the victim's machine.
But before going hands on let me tell you some history about this ransomware the hidden tier was an
open source project whose goal was to create a simple ransomware in C sharp.
Unfortunately the project was abandoned on github but currently it has more than four hundred for it
so that you can easily go to get.
Find any of these forks and downloaded the ransomware uses the symmetric ATX algorithm to encrypt the
files of the victim it will then send the symmetric key to a server that we will set up and will leave
the victim with a text file.
Having a message that explains what happened you need first to install Visual Studio that supports C
sharp language then we will go to get hub and install one of the forks of the hidden tier ransomware.
We will open the files or the projects in Visual Studio added those.
After that we will set up a web server on Carly.
We will configure the observer to receive the encryption keys.
Then we will move the ransomware and the descriptor to the victim's machine and execute the attack.
First of all you need to go to get hub to this link here and you need to clone the project.
After that you open the downloaded file and you will be presented by two main folders or two main projects.
The hidden tier which is a solution and Visual Studio and the descriptor which will decrypt actually
the files after you extracted the loaded file double click on the hidden tier and open it in Visual
Studio.
Right click on the form one dot see sharp and press on view code.
Let us walk through this to make our own hidden tier ransomware.
This actually is the target of the server that we will need to setup so we will put the IP here of our
server.
Then we will create a simple BHP file that will get the encryption keys via the info parameter scrolling
down.
You will be able to see the extension of the encrypted files.
You can change that to your own extension
below you will be able to see all the extensions of the files that will be encrypted.
You can add and remove any of the files that you want to encrypt on the victim's machine.
We'll leave that as is for now.
Scrolling towards the end of the source code you will be able to see that path.
This is the path of the attack.
So here in this example the ransomware will only attack or will only encrypt the files under the test
folder which is found on the desktop navigating towards the end of the source code.
You will be able to see the text file that we will create on the victim's machine and the message that
we will put in this text file for example like this message you have been hacked.
Send us an amount of 0 point 5 bitcoins to this address.
To view your files again saw this or read it file will be under the test folder on the desktop.
The most important part to explain is this target serial.
So here in this target your l you are sending the key from the victim to the web server that you have
set up that will contain the encryption key.
So for the sake of this tutorial we will create a web server on the Kelly machine.
So here you will have the IP of the web server.
Then we will create a file or BHP file on the root directory of the web server to receive the key.
So for this purpose let's remove that here.
The file we will call it
he's not BHP.
So we will create the page file on the directory and we will get the information through the info parameter
on that.
Here you need to populate the IP of the web server.
In this case it is
2 1 1 that 1 4 3
setting up the web server is quite easy.
Go to a color machine and navigate to war.
The up HMO lists the contents here.
You have the index of BHP so no you need to create the keys the BHP file use.
Edit
He's the BHP and once this file opens.
Just paste this code.
So this is actually the script.
The BHP script and the Keystone BHP file that will get the data from the info get parameter and put
it in the data.
The DST file for this purpose as well.
We need to create the data the text file in the same root path of our web server.
Make sure you save this file don't we need to create the data.
The text file as well so use the same command to edit data.
The DST open the file and make sure to save it after you create the data to see it's important.
Granted access so you go here.
Var w w w h then L right click on Data takes D properties then permissions go to the group navigate
to w w w dash data and give it read and write access.
Now let's list the directory here.
We have the data the text to save the encryption files and the keys though BHP which has the BHP scrip
that will get the information in the info get parameter.
The only thing left to do is to start the Apache service
and here we go.
Now everything is ready in place for the attack.
After you've edited the file with the extension of the encrypted files the extension types and the folder
that we gonna to attack along with writing up the message the victim each school here to build and compile
the project.
Now if you navigate to the hidden tier folder that you've downloaded under the bin and under the debug
folder you'll be able to see the hidden tier in that XY file open the decrypted source code in visual
studio and match the extension that you've written in the ransomware.
Make sure to go to the path and updated logo to build and compile the solution navigating to the decrypted
folder bin debug folder.
You will be able to see that decrypted that EFC file has been created.
Now we will move the ransomware and decrypt the file to the victim's machine.
For the sake of this tutorial I think created the test folder on the desktop and I've created text file
in that let's call it demo and that demo file you will see this is a demo for the hidden tier ransomware.
You can as well as many files as you want with the extensions that are listed in the source code of
ransomware.
Now we will double click on the ransomware and notice what will happen.
The file will change to red Python extension and it will be encrypted and you file as well will be populated
that has our message.
Now let's go to the Kelly machine.
Remember in the same directory we had the file data or text.
So let's check what's in that file as you can see here.
This is the name of the machine of the victim's machine.
This is the user name of the victim and this is the key used to encrypt the file.
Now in order to decrypt the files just run the hidden decrypted base the password which is this one
and then click decrypt files to have them decrypted.