Cyble Research and Intelligence Labs (CRIL) tracked phishing campaigns distributing a fake ransomware that does not encrypt files but renames them, drops ransom notes, and threatens payment. The campaign uses masquerading techniques (double extensions like SexyPhotos.JPG.exe) and a multi-stage dropper with persistence and network activity to convey ransom instructions. #Cyble #CRIL #FakeRansomware #ReadmeTxt
Keypoints
- The Fake Ransomware is distributed via phishing links on adult/dating sites and masquerades as a legitimate image file with a double extension (e.g., SexyPhotos.JPG.exe).
- On execution, the malware drops four executables (del.exe, open.exe, windll.exe, and windows.exe) and one batch file (avtstart.bat) in the %temp% folder and runs them.
- Persistence is achieved when avtstart.bat copies all dropped executables to the Startup folder.
- The malware renames a broad set of files (Locked_.Locked_fille) and uses exception.lst to exclude certain extensions from renaming.
- It drops and executes a sequence of VBS/BAT files (windowss.VBS, windowss.bat, Readme.txt) and later windll.VBS/windll.bat to propagate the ransom note across locations.
- The activity includes deleting system drives via a del.exe/dell.exe chain, and it ends with the Open process that connects to a tainted URL to display or retrieve a ransom note/instructions.
- Unlike real ransomware, the sample does not encrypt files; it only renames them and displays a ransom note, raising questions about decryptor feasibility and effectiveness.
- Best practices recommended include regular offline backups, enabled updates, reputable security software, and cautious handling of untrusted links.
MITRE Techniques
- [T1204] User Execution – The user is directed to download the fake ransomware via phishing links. “The link of this website may be available on dating websites that redirect the user to download the fake ransomware after opening it.”
- [T1059] Command and Scripting Interpreter – After download, the malware drops multiple executables and a batch file and executes them. “Upon execution, the malware file drops four executable files (del.exe, open.exe, windll.exe and windows.exe) and one batch file (avtstart.bat) in %temp% directory and executes them.”
- [T1064] Scripting – The chain of VBS/BAT files is used to perform actions such as file renaming and ransom note propagation. “The .VBS file further executes windowss.bat which initiates the Fake ransomware activity.”
- [T1547] Registry Run Keys / Startup Folder – Persistence achieved as avtstart.bat copies executables to Startup folder. “avtstart.bat runs and it copies all the executable files to Startup folder for persistence.”
- [T1036] Masquerading – The downloaded executable is masqueraded as an image with a double extension (SexyPhotos.JPG.exe). “double extension i.e. SexyPhotos.JPG.exe and masquerading as an image file”
- [T1027] Obfuscated Files or Information – The rename operation and presence of exception.lst show attempts to hide/skip certain extensions. “reads exception.lst which contains the extensions to be excluded from the rename operation.”
- [T1083] File and Directory Discover – The malware enumerates folders and extensions for the rename operation. “The below table shows the folders and file extensions used by the malware for performing rename operations.”
- [T1082] System Information Discovery – The analysis context references the file/folder set used during operation.
- [T1486] Data Encrypted for Impact – The malware attempts to delete system drives as part of destructive behavior. “deletes all system drives [A: – Z:] except C: drive.”
Indicators of Compromise
- [SHA256] Main Exe – fbb21d552b04494bf40cf5aded24601449dfa8d597325e8d4169d345fe185f15
- [SHA256] Avtstart.bat – a7cc8279079b0607b26e96f015f80fdc2d859c718580cefdcd71f68d3f2343ae
- [SHA256] Del.exe – 5e742ede76bded5a5dc6d7a8f5594d013c50e6a0d6b703a21ffebb5f541b5304
- [Filename] avtstart.bat – listed as dropped and used for persistence
- [Filename] windowss.exe – listed as a dropped executable in the dropper chain
- [URL] hxxps[:]//lllllllllll.loseyourip[.]com/downloads – network location used to fetch or fetch ransom-related content
- [Domain] llllllll.loseyourip.com – domain referenced in the network stage
- [Filename] Readme.txt – ransom note and instructions
Read more: https://blog.cyble.com/2022/10/06/fake-ransomware-infection-under-widespread/