What Caused the Sudden Rise in Ransomware Attacks?
Ransomware attacks are on the rise again as the holiday shopping season approaches. Traditional ransomware has been known for encrypting files to demand ransom on compromised systems. However, the latest ransomware attempted to perform additional malicious behaviors, such as leaking personal information. AhnLab Security Emergency-response Center (ASEC) researchers have analyzed and published the trend of recent ransomware that has been prevalent since November.
1. Increase in new ransomware and variants
A new ransomware that looks almost identical to Sodinokibi (also known as BlueGrab) ransomware has been recently discovered. The new ransomware has been identified as ‘AnteFrigus,’ and its ransom note is shown below in Figure 1.
Figure 1. Ransom note of AnteFrigus
AnteFrigus only encrypts the files and folders in D, E, and F drive, thus excluding the C drive. When the encryption was completed, AnteFrigus ransomware changed all filenames to .qrja.
The attacker then shows an additional warning message after the ransom note closes, as shown in Figure 2, to pressure the user to pay the ransom.
Figure 2. Warning message of AnteFrigus ransomware
AhnLab’s V3 anti-malware solution detects the ransomware using the following aliases.
<V3 Aliases>
- Trojan/Win32.MalPe
- Malware/MDP.DriveByDownload.M1153
2. Confidential information stolen from infected PCs
A day after AnteFrigus ransomware was found, another ransomware was identified similar to that of Sodinokibi ransomware. Only this time, it changed filenames of encrypted files to .mosk while using similar attack method to that of Stop ransomware.
Figure 3. Filename changed to .mosk
The ransomware not only encrypts files and folders, but it also downloads info-stealer by accessing specific URLs. Also, the malware steals the browser information and cookie information of the user’s PC and sends it back to the attacker’s server (C&C) only to delete itself.
The ransomware also duplicates and registers itself in the registry to run automatically, modifying the access controls of the parent directory and preventing the copy ransomware from being deleted. This makes it nearly impossible for security solutions to access and delete the ransomware copy. However, current V3 products detect and remove the ransomware using the following aliases.
<V3 Aliases>
- Trojan/Win32.AnteCrab
- Malware/MDP.Ransom.M1171
3. Disguised as AV program and Windows files
On November 10th, a ransomware changing filenames to .bigbosshorse after file encryption was found disguised as a Windows system file (dllhost.exe). AhnLab's analysis revealed that the ransomware was generated on October 29th. On the same day, another ransomware was generated that disguised as a specific AV (Anti-Virus) program file (avgdiagex.exe).
Figure 4. Ransom note of bigbosshorse
The main characteristics of this new ransomware is that it checks the user language of the infected PC, as shown in Figure 5. If the user language is either Russian (0x419) or Kazakh (0x43F), it is terminated without performing any malicious behavior.
Figure 5. Code checking the OS language
AhnLab’s V3 antivirus products managed to block and provide alerts on unknown and little-known ransomware using behavioral-based detection. V3 products detect and block the ransomware using the following aliases.
<V3 Aliases>
Malware/Win32.Ransom.R298611
Malware/MDP.SystemManipulation.M1751
Malware/MDP.Ransom.M1946
Is it generated by the same group?
AnteFrigus ransomware or .mosk ransomware had the same appearance as Sodinokibi ransomware. Thus, we cannot ignore the likelihood that the same threat group could have either generated or distributed these recent ransomware.
