ReversingLabs reports AstraLocker 2.0 is distributed directly from Microsoft Word phishing documents, leveraging leaked Babuk code and a “smash and grab” approach for rapid impact. The campaign uses an old packer, anti-analysis checks, and Monero/BTC wallets for ransom, highlighting the ongoing risk from Babuk-code leaks being repurposed by lower-skill actors. #AstraLocker #Babuk #ChaosRansomware #Monero #Bitcoin
Keypoints
- AstraLocker 2.0 is distributed via Microsoft Word documents used in phishing attacks, with the payload stored in an OLE object and activated after user interaction.
- The threat actor appears to favor a fast, high-impact approach (“smash and grab”) rather than a slow, methodical intrusion.
- The malware is a fork of Babuk, with shared code and campaign markers, suggesting the Babuk leak influenced this campaign.
- AstraLocker 2.0 uses an old packer (SafeEngine Shielden v2.4.0.0) to hinder reverse engineering and employs obfuscation tactics.
- Defense-evasion techniques include VM/sandbox checks, window-name checks for analysis tools, and debugger-detection techniques.
- Encryption and disruption tactics include stopping security tools, killing interference processes, deleting shadow copies, encrypting files (Curve25519), and targeting network shares.
- Campaign markers include a mutex name, a distinctive file footer, a unique file extension (.babyk), and Monero/BTC wallets linked to the ransom note; the note’s lack of contact email raises questions about victim communication.
MITRE Techniques
- [T1566.001] Phishing – Spearphishing Attachment – AstraLocker 2.0 was distributed directly from Microsoft Word files used in phishing attacks. ‘recipients who opened the malicious Word attachment were required to make multiple, additional clicks to activate the embedded ransomware.’
- [T1204.002] User Execution – The lure requires user interaction to run the embedded executable; ‘the payload is stored in an OLE object; the lure only activates the ransomware if the user double clicks the icon in the document and consents to running an embedded executable named “WordDocumentDOC.exe:”‘
- [T1027] Obfuscated/Compressed Files and Information – The samples used an outdated packer SafeEngine Shielden v2.4.0.0 to complicate reverse engineering and injects indirect jumps to obfuscate control flow. ‘The packer checks running processes to determine if it is in an analysis environment…’
- [T1497] Virtualization/Sandbox Evasion – Anti-analysis checks including VM detection and analysis-tool window-name checks. ‘The packer checks running processes to determine if it is in an analysis environment’ and ‘searched for … Regmonclass, the window name associated with Registry Monitor…’
- [T1562.001] Impair Defense – Stops backup/anti-malware/endpoint security tools and kills processes that could interfere with encryption. ‘Stops a list of backup and anti-malware and security services’ and ‘The AstraLocker malware also attempts to disable applications that may block- or interfere with the encryption of data.’
- [T1490] Inhibit System Recovery – Deletes Volume Shadow Copies to hinder recovery. ‘Deletes Volume Shadow Copies using the command … vssadmin.exe delete shadows /all /quiet.’
- [T1486] Data Encrypted for Impact – Encrypts files using Curve25519 after unpacking. ‘Encrypts files with the Elliptic Curve Cryptography algorithm Curve25519’
Indicators of Compromise
- [SHA256 Hash] AstraLocker 2.0 Ransomware – cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3, b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9, and 4 more hashes
- [SHA256 Hash] AstraLocker 2.0 Ransomware – 17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565, 08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6
- [SHA256 Hash] AstraLocker 2.0 Ransomware – 5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821
- [SHA256 Hash] Malicious Word Document – 60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127
- [SHA256 Hash] Malicious Word Document – 71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e
- [Wallet Address – Monero] 47moe29QP2xF2myDYaaMCJHpLGsXLPw14aDK6F7pVSp7Nes4XDPMmNUgTeCPQi5arDUe4gP8h4w4pXCtX1gg7SpGAgh6qqS
- [Wallet Address – BTC] bc1qpjftnrmahzc8cjs23snk2rq0vt6l0ehu4gqxus – The Bitcoin wallet address used by AstraLocker 2.0 campaign