The SonicWall Capture Labs threat research team have been tracking ransomware that encrypts and gives files a “.snoopdog” filename extension.  The operator charges 1 BTC for file retrieval.  However, as with most ransomware today, the price is negotiable and a discount may be provided to the victim.

 

Infection Cycle:

 

Upon execution, the malware encrypts files on the system.  Each file is given a “.snoopdog” extension to indicate that it has been encrypted.

 

The following files are dropped onto the infected system:

• %APPDATA%\Roaming\noputana.exe (copy of original malware) [detected as: GAV: Snoopdog.RSM (Trojan)]
• %APPDATA%\Roaming\userkey.dat
• !DECRYPT_FILES.txt (dropped in all dirs where files were encrypted)

 

The following keys are added to the registry:

• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HelloAV “%APPDATA%\Roaming\noputana.exe”
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WelcomeBack “%APPDATA%\Roaming\!DECRYPT_FILES.txt”

 

!DECRYPT_FILES.txt contains the following message:

 

userkey.dat contains the following data:

1WOD64X5CWPMX8

 

The following applications are killed if found to be running:

msftesql.exe vmware-vmx.exe vmware-authd.exe sqlagent.exe sqlbrowser.exe sqlservr.exe
sqlwriter.exe oracle.exe ocssd.exe dbsnmp.exe synctime.exe mydesktopqos.exe
agntsvc.exe isqlplussvc.exe xfssvccon.exe mydesktopservice.exe ocautoupds.exe
agntsvc.exe agntsvc.exe agntsvc.exe encsvc.exe firefoxconfig.exe tbirdconfig.exe
ocomm.exe mysqld.exe mysqld-nt.exe mysqld-opt.exe dbeng50.exe sqbcoreservice.exe
excel.exe infopath.exe msaccess.exe mspub.exe onenote.exe outlook.exe powerpnt.exe
steam.exe thebat.exe thebat64.exe thunderbird.exe visio.exe winword.exe wordpad.exe
taskmgr.exe

 

The tOr link leads to the following page:

 

A Telegram link (http://t.me/SENDMYiDbot) is provided for communication with the malware operators.  We had the following conversation with the operator:

 

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: Snoopdog.RSM (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.

SonicWall Threats Research team observed an AndroidBot malware that contains multiple obfuscation layers that hides the hardcoded URLs and malicious code. Similar to a number of Android malware, this malware drops the dex file during execution that contains malicious code.

Sample details

• MD5: 04533b259e5623638184a37ce8a16ffb
• Package Name: com.qkjwie45.ngirwii
• Application Name: application

At the time of writing this blog, this sample is hosted on the following link:

Infection Cycle

The app requests for a number of permissions, below are a few risky ones:

• android.permission.CALL_PHONE
• android.permission.CAPTURE_VIDEO_OUTPUT
• android.permission.DISABLE_KEYGUARD
• android.permission.READ_CONTACTS
• android.permission.READ_SMS
• android.permission.RECEIVE_BOOT_COMPLETED
• android.permission.RECEIVE_SMS
• android.permission.REORDER_TASKS
• android.permission.REQUEST_DELETE_PACKAGES
• android.permission.REQUEST_INSTALL_PACKAGES
• android.permission.SEND_SMS
• android.permission.SYSTEM_ALERT_WINDOW
• android.permission.WRITE_EXTERNAL_STORAGE
• android.permission.WRITE_SMS

 

Upon installation and execution the application requests for accessibility permissions, once granted the application gains the ability to execute its malicious components:

 

The main class listed in the Manifest.xml file is not present in the decompiled codebase:

 

The malware drops a file – agAzJPYW.dex – during execution which is actually the dex file that contains malicious code.:

 

This dex file contains the main activity which is listed in the original manifest.xml file:

 

The malware obfuscates the strings present in the code to deter security researchers from analyzing the malware and automated tools from identifying suspicious strings in the code:

 

However, the decryption routine is also present in the code which can be used to decode the strings:

 

Decoded string:

 

We identified several interesting bits when the strings were decoded:

 

 

 

Capabilities

This bot is capable of performing a series of malicious/dangerous actions on an infected device, some of them include:

• Show custom notifications
• Screencast/screencapture
• TeamViewer execution
• Read, write and send messages
• Extract information about running processes
• Extract information about the device
• Load URLs
• Receive messages via Fire Cloud Messaging (FCM)
• Install and remove applications
• Subscribe to premium messaging services
• Check if emulator is present

 

Hardcoded URLs

The class BotConfigs contained an interesting string titled Admin URL. Upon deobfuscation we got the string – http://das37rwa5cyfkb7o.onion/api/mirrors. After a series of layers we ultimately obtained a login page on the link newspotheres.xyz:

 

Based on the hardcoded url’s obtained in the code we created a VirusTotal Graph as shown below:

 

SonicWall Capture Labs provides protection against this threat via the following signature:

• AndroidOS.AndroidBot.DX

 

Indicators of Compromise (IOC):

• 04533b259e5623638184a37ce8a16ffb

 

We have blacklisted the following URLs:

• https://newspotheres.xyz
• https://babosiki.buzz
• https://trustpoopin.xyz
• https://trygotii.xyz
• https://trytogoi.xyz

 

The SonicWall Capture Labs Research team has been observing a massive increase in ransomware attacks with increasingly targeted attacks hitting mostly critical infrastructures. With companies willing to pay millions in ransom payment to restore operations, the ransomware industry has never been more lucrative for cybercriminals. This week we have observed a spike in detections for a somewhat small player in the ransomware world. We have first spotted Prometheus ransomware in February and have not seen a lot of action until this week.

Interestingly, with Revil Ransomware in spotlight for which a lot of the high profile ransomware attacks have been attributed to lately, Prometheus ransomware claims to be from the same cybercriminal group. We have no proof that this is true, however.

Infection Cycle:

Upon execution, the first thing this ransomware does is to find and delete Raccine, an open source program that blocks ransomware from deleting shadow copies of a system’s data – a very common ransomware behavior. It employs taskill.exe to kill the Raccine executable, if it happens to be present in the system as well as delete any Raccine-related registry values.

It then continues to kill other running processes using taskkill.exe including Microsoft Office processes like winword.exe, excel, mspub and visio, sql database related processes like sqlservice.exe, dbeng50.exe, mysqld.exe, among many others.

It also employs sc.exe to configure certain system services such as “SQLwriter start” to disable the functionality to be able to create backup and restore SQL Server data through the Volume Shadow Copy Service.

To ensure network connectivity it pings a loopback address 127.0.0.7

It also executes netsh.exe to run commands to alter the firewall settings to allow the infected system to be discoverable within the network and to allow for files and printer sharing.

Once target files have been encrypted, it displays an alert on the system tray and also opens an hta file with instructions on how to pay and retrieve files.  The header of the instructions imparts that Prometheus belongs to the well-known Revil ransomware group.

 

Another similar sample that we analyzed appears to be a more beefy program with more functionalities such as running commands to check the ARP table which can possibly be used for ARP attacks.

Also running a powershell command to delete all volume shadow copies.

And also trying to configure and login to the local router admin page using additional dropped components.

This newer version also provides additional ways to reach the ransomware authors outside of the Tor browser.

This goes to show that we will mostly likely see more from this ransomware group because they have been continuously improving their program with more robust functionalities to improve infection and possibly evade detection.

This week, we have noticed an uptick in detection for this particular ransomware.

SonicWall Capture Labs provides protection against this threat via the following signatures:

• GAV: Prometheus.RSM (Trojan)
• GAV: Prometheus.RSM_1 (Trojan)
• GAV: Prometheus.RSM_2 (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.