I ran across some interesting malicious spam (malspam) on Tuesday morning 2017-04-11. At first, I thought it had limited distribution. Later I found several other examples, and they were distributing yet another ransomware variant. I personally haven't run across this paricular ransomware until now.
The ransomware is very aware of its environment, and I had use a physical Windows host to see the infection activity. This diary examines the malspam and its associated ransomware.
I collected 14 samples of the malspam on Tuesday 2017-04-11. It started as early as 14:12 UTC and continued through at least 17:03 UTC. Each email had a different subject line, a different sender, different message text, and a different link to click.
The following links were in the emails. All are subdomains of ideliverys.com on 188.8.131.52 port 80. The domain ideliverys.com was registered the day before on Monday 2017-04-10.
Any given moment, each email link led to a 404.html page that redirected to the same fake Office portal URL. The following were Microsoft Office portal pages with links to the ransomware:
These fake portal pages all had links for Google Docs URLs that returned the ransomware. The ransomware was disguised as an Office plugin. Those URLs (at least the ones I've seen so far) were all reported to Google.
The ransomware samples didn't run properly on my virtual machine (VM). The samples also didn't run properly on free sandbox tools like malwr.com and reverse.it. I finally got an infection using a physical Windows host. The encrypted files were all renamed with .MOLE as a file extension. Decryption instructions were dropped as a text file named INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT to the desktop and any directory with encrypted files. Email addresses from the instructions were email@example.com and firstname.lastname@example.org.
There wasn't much on the post-infection traffic. The infected host merely retrieved a public key and provided a file count (for the encrypted files) during the ransomware callback. Characteristics of the ransomware binaries follow.
Post-infection callback by the ransomware:
My final words today are similar to my final words for yesterday's diary on Dridex malspam.
As usual, humans are the weakest link in this type of infection chain. If people are determined to bypass all warnings, and their systems are configured to allow it, they will become infected. Unfortunately, that's too often the case. I don't believe the situation will improve any time soon, so we can expect these types of malspam campaigns to continue.
Emails, malware samples, and pcaps associated with the 2017-04-11 ransomware malspam can be found here.
Apr 12th 2017
2 weeks ago
Update: The first sample I had didn't run properly on malwr.com or reverse.it. The second sample did.
Apr 12th 2017
2 weeks ago