A new variant from Chaos Ransomware family surfaces
The SonicWall Capture Labs Research team has received a sample of a new variant from Chaos Ransomware family which is a customizable ransomware builder that emerged in underground forums, by falsely marketing itself as the .NET version of Ryuk.
It provided the following customizable options which a cybercriminal can use to customize a ransomware.
- processName = “svchost.exe”;
- sleepTextbox = 10;
- spreadName = “surprise.exe”;
- userDir = “C:\\Users\\”;
- checkAdminPrivilage = true;
- checkCopyRoaming = true;
- checkdeleteBackupCatalog = true;
- checkdeleteShadowCopies = true;
- checkdisableRecoveryMode = true;
- checkSleep = false;
- checkSpread = true;
- checkStartupFolder = true;
- droppedMessageTextbox = “read_it.txt”;
- encryptedFileExtension = “”;
- encryptionAesRsa = true;
- messages = new string[]; #Ransomware message content
Infection Cycle:
At the start of the execution it checks its own filename and the location from where it is running.
If the process name and the location name is not %appdata%\\svchost.exe, it drops a copy of itself to %appdata%\\svchost.exe and launches it.
After that it checks for the “checkSleep” variable which is provided at the time of building ransomware, if the value is False is will skip executing the sleepOutOfTempFolder(), function which also checks the folder location form where it is running and if the path does not matches, it uses another count variable “sleepTextbox” whose value is multiplied by 1000 times and resulting value is passed to thread and sleeps for that many milliseconds.
It then checks for the checkStartupFolder flag and if its true it calls addLinkToStartup() function.
It creates a file svchost.url in which it adds the location of the file and copy the file into User Startup folder to
enable its automatic execution at every system startup
It has a hardcoded list of directories and files with valid extension in those directories are only encrypted.
List of the extension
Before encrypting the file it checks for the list of valid file extensions and the filename should not be one in the droppedMessageTextbox supplied at the time of building the ransomware.
This droppedMessageTextbox contains the name of the file which contains the ransomware message.
In our case the filename is “read_it.txt”;
Before encrypting the file it checks for the File length.
If the file length is below 2,117,152 bytes, it encrypts the file using EncryptFile method and if the size is bigger than
2,117,152 bytes a random string of a random length between 200000000 and 300000000 bytes is generated and encoded using the randomEncode method.
It creates a 20 byte random password and converts the password to a byte array using UTF8 encoding.
The content of the file is then AES encrypted using that key.
It then encrypts the key generated earlier using the RSA encryption
AES encrypted content are again converted into Base64 encoding.
It then concat the RSAEncrypted key and base64 encoded content into the file using File.WriteAllText method.
Finally, original file is moved to same location by appending a random extension using the RandomStringForExtension method.
It then drops the “read_it.txt” containing the ransomware message on that location.
Once the encryption is done it delete Shadow Copies, disable Recovery Mode and delete Backup Catalog file using below commands.
“vssadmin delete shadows /all /quiet & wmic shadowcopy delete”
“bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no”
“wbadmin delete catalog -quiet”
In order or spread, it loops through all the available drives on the system and if the drive is not a C:\ drive and the spreadName file is not present on the system, It copies the malware’s file to that drive with the specified spreadName.
This way the malware can potentially infect other machines whose drives are mapped onto the victim’s machine.
Once the encryption is completed it displays the ransomware message text.
It set the below wallpaper
SonicWall Capture Labs provides protection against this threat via the following signature:
GAV:MalAgent.RSM_99 (Ransomware)
