Politically Charged Ransomware Weaponized as a File Destroyer

The SonicWall Capture Labs threat research team has been observing a growth of malware built using the Chaos ransomware builder. The sample we have analyzed here is built using this kit, however, it is not intended to work as traditional ransomware, but rather, as a file destroyer. The intent appears to be the destruction of files in response to Italy’s stance on the Israel-Palestine conflict. It purports to be created on behalf of the Italian Socialist Party and is likely aimed at infecting machines within the Italian government’s infrastructure.

Infection Cycle

The malware uses the following icon:

Upon infection, files on the system are encrypted. Each file is given a file extension consisting of four random alphanumeric characters. As this malware is intended to destroy files, the decryption key is probably not stored by the attackers for file retrieval later on in exchange for money. A file named “Leggimi.txt” (“Read me” in Italian) is dropped into directories containing encrypted files. It contains the following message in Italian:

A rough translation of that message is as follows:

—————————- -Ransomware route

Italy must be punished for its alliance with the fascist state
By Israel, this malware was scheduled by Marxisti-Leninisti-Maoisti
To spread the anti -medical thought. Of the Palestinians are dying for Your actions, I will kill your files. There is no way to recover them.

Palestine Libera
Italy Red Unit and Socialists

The message makes no mention of file decryption for payment and no contact information is presented. Any encrypted files are therefore irretrievable.

Reverse engineering the malware reveals a list of targeted file extensions:

We can also see a list of directories that are targeted:

An image file is embedded in the malware executable file. It is base64 encoded:

After decoding the image, it is displayed as the desktop wallpaper:

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: Cambiare_Rotta.RSM (Trojan)

This threat is also detected by SonicWall Capture ATP w/RTDMI and the Capture Client endpoint solutions.

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.