Exerwa ransomware leaked from CTF hacker event


The SonicWall Capture Labs threat research team has observed reports of Hungarian PC users infected by Exerwa ransomware. It is reported that Exerwa is CTF malware that emerged from a Capture-the-Flag event where hackers are tasked to build functional ransomware in the shortest possible time. Unfortunately, some code from this event has ended up in the wild. The code is very basic and the initial infection vector is via a word document using macros.


Infection Cycle:


Upon opening the Word document the following page is shown:


A .bat script can be seen on the second page:


Once the macro has run, the following files are dropped on to the system:

  • %USERPROFILE%\Exerwa\decode.bat
  • %USERPROFILE%\Exerwa\exec.enc
  • %USERPROFILE%\Exerwa\script.enc
  • %USERPROFILE%\Exerwa\exec.exe
  • %USERPROFILE%\Exerwa\script.ps1


script.enc contains the following encrypted data:


exec.enc contains the following encrypted data:


decode.bat is run.  It contains the following commands:



exec.enc is decrypted using the built-in Windows certutil program and exec.exe is created.  It is a non-malicious generic Xor encryption tool by Luigi Auriemma:


script.enc is decrypted with certutil and script.ps1 is created.  It contains the following powershell script:


This script contains a loop to encrypt files within a given directory using the Xor tool.  As shown in the script, “.exerwa” is appended to the names of encrypted files.



SonicWall Capture Labs provides protection against this threat via the following signature:

  • GAV: Exerwa.RSM (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.

Security News
The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.