Researchers observed new snake ransomware that written in Golang targeting Windows users to encrypt the system files and remove the Volume Shadow Copies that the OS uses for backup.
Snake ransomware is a targeted campaign that contains a standard ransomware feature with some of the more complex functionalities.
Malware authors choose the Golang language which is used to write some of the most recent ransomware families and utilized by some of the RaaS (Ransomware as a Service) offerings since it is flexible for cross-platform and completely open-source programming language.
Researchers believe that the campaign has the potential to do serious and critical damage to an infected environment.
Snake ransomware targeting the specific platforms such as SCADA, enterprise management tools, system utilities and also some of the specific targeted applications include VMware Tools, Microsoft System Center Operations Manager, Nimbus, Honeywell HMIWeb, FLEXnet,
Snake Ransomware Infection
Once it infects the system, relevant files are overwritten with encrypted data, and the encrypted files extension is changed as ” EKANS”.
Also, modified files added with random characters which used to make it more difficult to identify the specific ransomware family.
Malware authors used both symmetric and asymmetric cryptography to encrypt the victim’s windows system files.
A symmetric key is required for encrypting and decrypting of files, In this case, symmetric key used to encrypt the victim’s files with attacker’s public key and the decryption process is only possible by having the attackers private key.
Since the attackers using key lengths (AES-256, RSA-2048), which makes it impossible to crack the key and decrypt the data.
Snake ransomware also terminates the various system process of following.
According to SentinelOne research, “If the threat is executed with administrative privileges, the ransom note will be written to c:\users\public\desktop\Fix-Your-Files.txt. In the event that administrative privileges are not present, the ransom note will be written to an alternative location: c:\users\\AppData\Local\VirtualStore\”
Once the Snake ransomware completes the infection process and encrypted the system files, it drops the ransomware notes that contain the details about how to decrypt the files.
Instead of providing the web address to obtain the payment, authors are instructed the victims to contact them via the email address in the ransom note is “bapcocrypt @ ctemplar.com” to get the decryption key from the attacker.
Like most ransomware, Snake doesn’t touch your operating system files and programs, so your computer will still boot up, log in, and let you open your favourite apps, so that in purely technical terms you have a working system…
…but all your important data files, such as documents, spreadsheets, photos, videos, music, tax returns, business plans, accounts payable and accounts receivable, are scrambled with a randomly chosen encryption key.
Scrambled files consist of the encrypted content written back over the original data, with decryption information added at the end:
The original filename and directory are recorded, the decryption key is stored too, and the special tag EKANS, which is SNAKE written backwards, finishes off the encrypted file.
Note that the decryption key for each file is itself encrypted using public-key encryption, which is a special sort of encryption algorithm in which there are two keys, rather than one, so that the key used to lock data can’t be used to unlock it.
The key used for locking data is called the public key, because you can reveal it to anyone; the unlocking key is called the private key, because as long as you keep it private, you’re the only one who can later unlock the encrypted data.
Most modern ransomware uses this sort of hybrid encryption system.
The malware generates a random key to encrypt the file, using what’s called a symmetric or secret-key encryption algorithm where the same key both locks and unlocks; then uses a public key to lock up the random key.
To decrypt the file, you need the private key to unlock the symmetric key; then the symmetric key to unlock the file.
Why Snake?
But why the Snake part?
Why add the EKANS marker, unencrypted, at the end of every encrypted file?
We assume that the crooks behind the ransomware did this as an easy way of identifying an encrypted file if you decide to pay up and buy back the decryption key from them.
Most ransomware denotes scrambled files by adding a unusual extension to filenames so they stand out.
Sometimes this special extension adds ironic insult to injury, as in the case of the infamous SamSam ransomware, which added the truthless text .weapologize to the end of all your scrambled files.
But the Snake malware adds a different, randomly chosen string of characters to the names of encrypted files, so that they can’t reliably be picked out by name alone:
Once it’s scrambled your data, Snake dumps a “What happened to your files?” document on your desktop:
This malware actually writes this file, called Fix-Your-Files.txt, into what Windows calls the ‘public desktop’, usually in the directory C:\Users\Public, where it shows up in the background for every user on the system.
If the malware isn’t run with administrator privileges, then although it will be able to overwrite all your files, it won’t be able to write to the Public folder, and will end up in a special folder called \Users\[yourname]\AppData\Local\VirtualStore, where you’re likely to miss it.
We think these crooks expect to have administrator access across a compromised network to inflict maximum damage, and have programmed their malware on that basis.
As the “What happened to your files?” document itself says:
We breached your corporate network and encrypted the data on your computers. The encrypted data includes documents, databases, photos and more.
So here’s the bad news to counter the goodish news we started with: the crooks behind this ransomware don’t intend to target individual users on your network, but instead take their time and go after everyone, for a more shocking effect.
What to do
- Don’t run unexpected attachments. The crooks probably won’t send you the ransomware directly, but they will try to trick you into running remote access malware that lets them get back in later so they can attack from right inside your network.
- Don’t open up remote access to your network unless you really mean to. Lots of ransomware attacks start because remote access systems such as RDP (remote desktop protocol) were open unexpectedly, and therefore hadn’t been secured properly.
- Don’t ignore warning signs in your security logs. Modern ransomware attackers usually spend hours, or even days, scoping out your network so they can scramble as many computers as possible to demand a bigger payout. If you spot them first, you many be able to head them off entirely.
- Don’t let users talk you into softening up login security. Features such as 2FA, where you need to copy a one-time code off your phone every time you login, add a tiny inconvenience for users compared to the extra difficulty they add for attackers.
- Don’t rely entirely on real-time, online backups. Most contemporary attackers search out and delete any online backups they can find, making it harder to recover without paying. Backups locked away in an old-school safe can’t be reached across your network!
