Ako ransomware demands $3000. Operators hide behind tOr.

The SonicWall Capture Labs Threat Research Team have recently come across a new variant of Ako ransomware.  The malware spreads via spam email and shares similarities to MedusaLocker.  This has lead many to believe that the malware is a variant of MedusaReborn.  However, the operators have reportedly denied this claim and state that Ako is thier own creation.  The malware demands $3000 USD in Bitcoin for file retrieval.  The operators run a website hosted behind tOr to facilitate file decryption for its victims.

Infection Cycle:

Upon infection, the malware encrypts files and appends <.random{6}> to their filenames.  eg. finance.docx.C564Ec

The following files are dropped into directories where files were encrypted:

• ako-readme.txt
• id.key

ako-readme.txt contains the following text:

:

id.key contains the public key used to encrypt files.

During the encryption process, the following file types are ignored:

.exe ,. dll, .sys, .ini, .lnk, .key, .rdp

Folders containing the following strings are also skipped:

Appdata
Program files
Program Files (x86)
Appdata
boot
Perflogs
Programdata
Google
Intel
Microsoft
Application data
Tor browser
Windows

Each encrypted file is given the following infection marker (CECAEFBE):

The following keys are added to the registry:

• HKEY_CURRENT_USER\Software\akocfg aid “.<random{6}>”
• HKEY_USERS\S-1-5-21-3032013890-123666948-3153623785-1001\Software\akocfg aid “.<random{6}>”

The following commands are executed to delete shadow copies of files and to disable any possibility of system recovery and repair:

vssadmin.exe Delete Shadows / All / Quiet
bcdedit.exe / set {default} recoveryenabled No
bcdedit.exe / set {default} bootstatuspolicy ignoreallfailures
wbadmin DELETE SYSTEMSTATEBACKUP
wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
wmic.exe SHADOWCOPY / nointeractive

The ransom note contains the following tOr address:

http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN

The address leads to the following site hosted on the tOr network:

After entering the unique key from the ransom note, the following page is presented which states that 0.2932 BTC (approx $3000 USD at this time) is required to restore files:

Activity recorded for the supplied BTC address (1Ag76nHNv1mPUf3Qki1EnoHgV4Cbt6dLft) suggests that the operators may have been successful in their endeavours:

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: Ako.RSM (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.