Ransomware Recap: Notable New Ransomware and the Aftershocks of Major Outbreaks

This week the conversation is still about the two ransomware responsible for the widespread chaos that affected organizations across the globe—WannaCry and Petya. WannaCry was detected in early May, but there were recent outbreaks in countries across Asia and in Australia. Meanwhile, the repercussions of Petya are still being felt. Experts are dissecting the details and trying to find the motivation behind this attack, as well as who is still vulnerable.

Other notable ransomware of the week

The downloader hashes for Karo ransomware (detected by Trend Micro as RANSOM_KARO.A) were actually included in a Github repository for Petya-related IOCs, but Karo is a unique threat on its own. It is a MSIL-compiled (which needs a .NET framework in order to work) and obfuscated file that typically arrives in a macro-enabled document that uses a Powershell downloader code. This isn’t the first ransomware to use this technique, and we’ve previously discussed why more and more attackers are abusing Powershell.

Using the de4dot tool, which is an open source .NET deobfuscator and unpacker, we also found that it has anti-sandbox features:

Figure 1. Snippet of code from Karo

There are a few other notable ransomware to come out over the past week. Recently the infamous crypto-ransomware SamSam (detected as RANSOM_SAMAS) has been more active. Reports show that it now demands a substantial ransom from its victims, as much as 12 BTC—roughly US$31,600—to decrypt multiple devices.

ViACrypt (detected by Trend Micro as RANSOM_ VIACRYPT) is a newer, potentially harmful ransomware that uses RSA-1024 algorithm to encrypt files and has a Latvian ransom note. Meanwhile, a Hidden Tear variant (detected by Trend Micro as RANSOM_HIDDENTEARBATTLEFIELD) is masquerading as an installer for the first-person shooter game Battlefield to trick gamers into installing it.

Figure 2. ViACrypt ransom note

The ransomware Gank (detected by Trend Micro as RANSOM_GANK), which appends the extension .ganklocked onto files it encrypts, is also notable. There is also the recently discovered ABCScreenlocker (detected by Trend Micro as RANSOM_ABCSCREENLOCKER), which simply locks the user out of his device.

Figure 3. ABCScreenlocker image

At the heels of these outbreaks, Microsoft released its contribution to protecting users from ransomware. Their recent Windows 10 Insider Preview Build introduces a new controlled folder access feature that “monitors the changes that apps make to files in certain protected folders. If an app attempts to make a change to these files, and the app is blacklisted by the feature, you’ll get a notification about the attempt.” Users can add certain folders that they want to protect, and also allow specific apps through the feature.

Enterprises and all users should use best practices and be proactive in protecting systems against ransomware.

Ransomware Solutions