The malware double extortion website is again up, with new victims and a message: “Despite your hopes, we are with you again”.
FBI spread a warning on the surge of Ragnar Locker activity
FBI cybersecurity experts spread a flash alert on the increase of the Ragnar Locker cybercrime activity. According to the document, the U.S. Bureau “first observed Ragnar Locker ransomware in April 2020, when unknown actors used it to encrypt a large corporation’s files for an approximately $11 million ransom and threatened to release 10 TB of sensitive company data. Since then, Ragnar Locker has been deployed against an increasing list of victims, including cloud service providers, communication, construction, travel, and enterprise software companies. The FBI is providing details of Ragnar Locker ransomware to assist with understanding the code and identifying the activity. Ragnar Locker actors first obtain access to a victim’s network and perform reconnaissance to locate network resources, backups, or other sensitive files for data exfiltration. In the final stage of the attack, actors manually deploy the ransomware, encrypting the victim’s data.”
The cybersecurity experts: The ransomware frequently changes obfuscation techniques, and uses a custom Windows XP virtual machine to avoid detection
According to the cybersecurity experts, “The Ragnar Locker ransomware family is frequently changing obfuscation techniques to avoid detection and prevention”. The malware “is identified by the extension ‘.RGNR_<ID>,’ where <ID> is a hash of the computer’s NETBIOS name. Furthermore, the actors, identifying themselves as ‘RAGNAR_LOCKER,’ leave a .txt ransom note, with instructions on how to pay the ransom and decrypt the data.” It “has used VMProtect, UPX, and custom packing algorithms. Ragnar Locker has been deployed within an attacker’s custom Windows XP virtual machine on a target’s site.” Furthermore, the ransomware “uses Windows API GetLocaleInfoW to get the infected machine’s current locale. If the victim’s locale is found to be ‘Azerbaijani,’ ‘Armenian,’ ‘Belorussian,’ ‘Kazakh,’ ‘Kyrgyz,’ ‘Moldavian,’ ‘Tajik,’ ‘Russian,’ ‘Turkmen,’ ‘Uzbek,’ ‘Ukrainian,’ or ‘Georgian,’ the process will terminate. The ransomware also checks for current infections to prevent multiple encryption transforms of the data, potentially corrupting it.”
The malware chooses which folders it will not encrypt
The FBI underlines that “the Ragnar Locker ransomware identifies all attached hard drives, whether assigned a drive letter or not, using Windows APIs: CreateFileW, DeviceIoControl, GetLogicalDrives, and SetVolumeMountPointA. The ransomware assigns a drive letter to any volumes not assigned a logical drive letter and makes them accessible. These newly attached volumes are later encrypted during the final stage of the binary. The malware iterates through all running services and terminates services commonly used by managed service providers to remotely administer networks.” Then, it “attempts to silently delete all Volume Shadow Copies preventing user recovery of encrypted files, using two different methods:
- 1) >vssadmin delete shadows /all /quiet;
- 2) >wmic.exe.shadowcopy.delete.
Lastly, Ragnar Locker encrypts all available files of interest. Instead of choosing which files to encrypt, Ragnar Locker chooses which folders it will not encrypt. Taking this approach allows the computer to continue to operate ‘normally’ while the malware encrypts files with known and unknown extensions containing data of value to the victim.” Moreover, “when iterating through files, the ransomware does not encrypt files with the following extensions: .db, .sys, .dll, and .lnk.