Malspam on 2017-04-11 pushes yet another ransomware variant, (Wed, Apr 12th)

Introduction

I ran across some interesting malicious spam (malspam) on Tuesday morning 2017-04-11. At first, I thought it had limited distribution. Later I found several other examples, and they were distributing yet another ransomware variant. I personally havent run across this paricular ransomware until now.

The ransomware is very aware of its environment, and I had use a physical Windows host to see the infection activity. border-width:2px" />
Shown above: Chain of events for an infection from this malspam.

The emails

I collected 14 samples of the malspam on Tuesday 2017-04-11. It started as early as 14:12 UTC and continued through at least 17:03 UTC. border-width:2px" />
Shown above: An example of the malspam.

Senders:

• USPS Ground lrnvaoy1467488@breakawaydistributing.com
• USPS Station Management oh53@fullertonautoservice.com
• USPS Priority jzj8127@holdintogold.com
• USPS Ground ritimyza607@rcn.cl
• USPS International n6784@atkinsonlandleveling.com
• USPS Ground osy7@brucezone.com
• USPS Priority Delivery w45@hhydro.com
• USPS Ground qucup08565428@rodarmex.com
• USPS SameDay ik844547@sheldons.com
• USPS Priority aohmiid6332@zvizdez.ru
• USPS Ground cjl66732@remiolofa.com
• USPS Ground pyasuj51@pffindia.com
• USPS Express Delivery utujim74880307@flyjetpool.com
• USPS Ground dip023221@mycanadore.ca

Subject lines:

• Delivery problem, parcel USPS #07681136
• Delivery problem, parcel USPS #766268001
• Delivery problem, parcel USPS #886315525
• New status of your USPS delivery code: 74206300
• New status of your USPS delivery code: 573677337
• New status of your USPS delivery code: 615510620
• Our USPS courier can not contact you parcel # 754277860
• Please recheck your delivery address USPS parcel 67537460
• Please recheck your delivery address USPS parcel 045078181
• Re:
• Status of your USPS delivery ID: 45841802
• We have delivery problems with your parcel # 30028433
• We have delivery problems with your parcel # 48853542
• We have delivery problems with your parcel # 460730503

The traffic

The following links were in the emails. All are subdomains of ideliverys.com on 47.91.88.133 port 80. The domain ideliverys.com was registered the day before on Monday 2017-04-10.

• uspsbiluwzxb48370.ideliverys.com - GET /u844
• uspsecjyuqke13584571.ideliverys.com - GET /tiyau72
• uspsnhes06611040.ideliverys.com - GET /p41733
• uspsoefi471.ideliverys.com - GET /zjhyi265
• uspsreoyohme58288.ideliverys.com - GET /yxot3007
• uspsrojafav558540.ideliverys.com - GET /qnympenw4
• uspsueyrbti3030420.ideliverys.com - GET /avega046508
• uspsuuougdeb13563307.ideliverys.com - GET /hip44
• uspsuxsazui65.ideliverys.com - GET /zuhjxai826625
• uspsvavy3.ideliverys.com - GET /qlwevgya2715078
• uspsvhxenco218438.ideliverys.com - GET /fgl0067027
• uspsvreid556443.ideliverys.com - GET /acai8521471
• uspsyvponyfu63.ideliverys.com - GET /ysiwc47537447
• uspszoaoohan13382521.ideliverys.com - GET /uzoxy330

Any given moment, each email link led to a 404.html page that redirected to the same fake Office portal URL. border-width:2px" />
Shown above: Example of a 404.html page leading to a fake Office portal URL.

These fake portal pages all had links for Google Docs URLs that returned the ransomware. The ransomware was disguised as an Office plugin. Those URLs (at least the ones I border-width:2px" />
Shown above: One of the fake Office portal pages with a Google Docs link for the ransomware.

The ransomware

The ransomware samples didnt run properly on my virtual machine (VM). The samples also didnt run properly on free sandbox tools like malwr.com and reverse.it. I finally got an infection using a physical Windows host. The encrypted files were all renamed with .MOLE as a file extension. Decryption instructions were dropped as a text file named INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT to the desktop and any directory with encrypted files. border-width:2px" />
Shown above: border-width:2px" />
Shown above: width:831px" />
Shown above: border-width:2px" />
Shown above: Registry entries created for persistence.

There wasnt much on the post-infection traffic. The infected host merely retrieved a public key and provided a file count (for the encrypted files) during the ransomware callback. Characteristics of the ransomware binaries follow.

First example:

• SHA256 hash: e6591a9389c7b82d59949b8c5660e773b86dff1fa3909f780cb8c88bbc85646c
• File name: plugin-office.exe
• File size: 376,832 bytes

Second example:

• SHA256 hash: 5ca18c9f5ec26a30de429accf60fc08b0ef785810db173dd65c981a550010dde
• File name: pluginoffice.exe
• File size: border-width:2px" />
  Shown above: Callback traffic from the pcap in Wireshark.

  Final words

  My final words today are similar to my final words for yesterdays diary on Dridex malspam.

  As usual, humans are the weakest link in this type of infection chain. If people are determined to bypass all warnings, and their systems are configured to allow it, they will become infected. Unfortunately, thats too often the case. I dont believe the situation will improve any time soon, so we can expect these types of malspam campaigns to continue.

  Emails, malware samples, and pcaps associated with the 2017-04-11 ransomware malspam can be found here.

  ---
  Brad Duncan
  brad [at] malware-traffic-analysis.net

  (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.