The worst alliance of Ransomware and the CryptoMiner family in a spread spree, early January 2019. Malware Spam or MalSpam is the term used to designate malware that is delivered via email messages.
Malicious spam (MalSpam) using zipped JavaScript (.js) files as email attachments–this is a well-established tactic used by cybercriminals to distribute malware. The infection traffic included GandCrab ransomware, a Monero (XMRig) cryptocurrency miner, and Phorpiex spambot traffic.
The email will be delivered with the initial JavaScript and it extracts an “
In the last 2 days, there were many samples found and many are uploading new samples in public sandboxes. In “app.any.run” a public sandbox, there are nearly 1200samples are uploaded and the spread seems to be high.
This GandCrab ransomware with CryptoMining seems to be critical and new variants of 2019. Get the IOC’s from your Cyber Intel and public sandboxes. The purpose of GandCrab, as with other ransomware, is to encrypt all or many files on an infected system and insist on payment to unlock them. The developer requires payment in cryptocurrency, primarily DASH, because of it complex to track, or Bitcoin.
Evolution of GandCrab Ransomware
GandCrab v1 Ransomware, were
discovered earlier in 2018. In nearly one month, over 50000 endpoints were
infected and encrypted. Unusually, this ransomware asked to pay ransom in the
cryptocurrency format “DASH”.
GandCrab v2 Ransomware, were discovered
in May 2018. With the new encryption extension of “.CRAB” and used more
sophiscated domains as CnC.
GandCrab v3 and v3.1 Ransomware were
discovered in later 2018 with more antivirus evading techniques.
GandCrab v4 Ransomware, brought many
changes in the workflow and the endpoint communication patterns. The new
extension “.KRAB” has been used and the creators have used new encryption
algorithm. Surprisingly this variant, doesn’t connect a CnC.
GandCrab v5 & v5.0.4 Ransomware brought many changes in the communication patterns and very advanced in the encryption standards. In later 2018, this created a greater impact and the increase of victims were huge.
What is CryptoMining Malware?
CryptoMining malware, or cryptocurrency mining malware or simply crypto jacking. Nowadays, Cyber criminals have increasingly turned to CryptoMining malware, as it’s a way to harness the processing power of large numbers of computers, smartphones and other electronic devices to help them generate revenue from cryptocurrency mining.
Therefore, they are infecting machines, utilize the device, encrypt using ransomware, destroy the traces and complete their actions. Cyber attackers are finding more ways in creating an alliance of various malware and combining them to achieve their goals.
Process Flow of the MalSpam
Recommendations to encounter this MalSpam
1.) Block email attachment names like “Love”, “Love_You”, “Luv_You”, “Love_You_”, etc. and try combinations more.
2.) Ensure the .js file types are blocked in your email gateway if not needed.
3.) Block all URL and IP based IoCs at the firewall, IDS, web gateways, routers or other perimeter-based devices.
4.) Ensure your SOC team are monitoring for the traces of ransomware activity.
5.) Ensure your SOC team is monitoring for the abnormal activity of Powershell Executions.
Indicators of Compromise
IP
74.220.215[.]73
78.46[.]77.98
92.63[.]197.48
136.243.13[.]215
138[.]201.162.99
198.105.244[.]228
217[.]26.53.161
Domains
gandcrabmfe6mnef[.]onion
icanhazip[.]com
osheoufhusheoghuesd[.]ru
slpsrgpsrhojifdij[.]ru
suieiusiueiuiuushgf[.]ru
www[.]2mmotorsport[.]biz
www[.]bizziniinfissi[.]com
www[.]fliptray[.]biz
www[.]haargenau[.]biz
www[.]holzbock[.]biz
hxxp://92[.]63[.]197[.]48/m/5[[.]]exe
hxxp://92[.]63[.]197[.]48/m/3[[.]]exe
hxxp://92[.]63[.]197[.]48/m/1[[.]]exe
hxxp://92[.]63[.]197[.]48/m/4[[.]]exe
hxxp://92[.]63[.]197[.]48/m/2[[.]]exe
hxxp://92[.]63[.]197[.]48/2[[.]]exe
hxxp://92[.]63[.]197[.]48/1[[.]]exe
SHA-256
