Trellix Insights: RansomEXX ransomware
Technical Articles ID:
KB93665
Last Modified: 2022-08-25 17:40:45 Etc/GMT
Last Modified: 2022-08-25 17:40:45 Etc/GMT
Environment
IMPORTANT: This Knowledge Base article discusses a specific threat that is being automatically tracked by Trellix Insights technology. The content is intended for use by Trellix Insights users, but is provided for general knowledge to all customers. Contact us for more information about Trellix Insights.
Summary
RansomEXX is a ransomware family that targeted multiple large companies starting in mid-2020. It shares commonalities with Defray777. Mid 2020 RansomEXX started spreading a Linux variant of their ransomware. The Linux version is a simple ransomware. It does not contain any code to terminate processes, including security software, does not wipe free space like the Windows version does, and does not communicate with a command and control server.
If a victim pays the ransom, they will receive both a Linux and Windows decryptor with the corresponding RSA-4096 private key and encrypted file extension embedded in the executable.
The Linux version is named 'decryptor64' and is a command-line driven decryptor.
Our Threat Research team will continue to monitor and update the RansomEXX ransomware profile and disseminate information that is deemed appropriate regarding the RansomEXX ransomware and victims.
How to use this article:
- If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign.
- Review the product detection table and confirm that your environment is at least on the specified content version.
To download the latest content versions, go to the Security Updates page. - Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
- Review
KB91836 - Countermeasures for entry vector threats . - Review KB87843 - Dynamic Application Containment rules and best practices.
- Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.
Threat Hunting:
{ meta: description = "Rule to detect Windows and Linux version of RansomeXX" author = "McAfee ATR team " rule_version = "v1" mitre_attack = "T1027,T1497.001,T1083,T1057,T1012,T1082,T1033,T1129,T1543.003" malware_type = "Ransom" malware_family = "Ransom:Win/RansomeXX" actor_type = "Cybercrime" actor_group = "Unknown" strings: $0 = {223E95459D82E1E7229F633169D26B57474FA337C9981C0BFB91314D55B9E9 1C5A5EE49392CFC52312D5562C4A6EFFDC10D0685A194D5E2B31581454DEF675FB79 58FEC7DB873E5689FC9D03217C68D8033820F9E65E04D856F3A9C44A4CBDC1D00846 F5983D771C1B137E4E0F9D8EF409F92ED254FCFF021E69D229C9CFAD85FA486C1B54B 8FF0642BFF521F15C1C0B665F3F34011656B429008F3563ECB5F2590723A054303D8A 7EA9889D903E077C6F218F44416AC2D1F53C583303917E6BE9EBE048E31E9E256718F 29229319C19F15BA4058CCFFDBBCB382D1F6F56585D8A4ADEC34C052CC0DA8D7345 1A} $1 = {FC54612808977EE8F548B2258D310BDC9D2D256B3EE9DAAE347BE6F4DC835A 467FFE8EB208F7E05D987A9B044A8E98C6B087F15A0BFC5D0689EF49D2FAE572B881B 123A85FFA21595F36F71C27109C692C1B56BBDCEB5B9D2865B3708DBC12A053384A9 C0C88E405A06C27DCF49ADA62EB2BB0E20B6E3116640286ED3A87A5713079B21F518 99B752E45573D4B39F4DBD3323CAB82BF63326BFB982F} $2 = {7C09E81700C11004018D9A9AEAC0F6596F559C6D4DAF59A5F26D9F200857C A6C3E9CAC524BD9ACC92ADC7E84BFDA79164B7ECD8486985D38604FEBDC6740D20 B3AC88F6AD82A4FB08D71AB47A086E86EEDF39D1C5BBA97C4080126141D67F37BE8 538F5A8BE740E484AE6852F8121067CC4BF7A5765577F39E7E24067817FAE0D7} $3 = {2A755EE16E1430B26E1430B26E1430B2943729B26C1430B2676CA3B2791430 B26E1431B2811430B201629BB2711430B201629AB2161430B201629FB2451430B20 162AEB2791430B20162ABB26F1430B20162ADB26F1430B2} $4 = {EC9B9FE9A3EADDA692CD43D2F59598ED858C02C2652FBF922EC454185E6A 16936E39334038ACEF838BFB186FFF7480ADC4289382ECD6D394F0AF85336B597A FC1A900B2EB21EC949D292DF4C047E0B2153} $5 = {16918F03F53C52DAC54ED8259740051E9C5FECF64344F7A82260EDCC304C65 28F659C77866A510D9C1D6AE5ECDC80D6FDDF18CAB34C25909C99A4174FCC28B8D} $6 = {004503615937300CE53865A20D27086D422F631D5F08017241651B402B190 50DDD54D3334D34224351BB2006285551897457671F526F38B091A20CD280000000} $7 = "!NEWS_FOR" fullword ascii $8 = "Study this message REGARDFULLY" fullword ascii condition: (uint16(0) == 0x5a4d or uint32(0) == 0x464C457F) and filesize < 500KB and 4 of them } |
Campaign IOC
Type | Value |
Minimum Content Versions:
Content Type | Version |
Detection Summary
IOC | Scanner | Detection |
IOC | Scanner | Detection |
IOC | Scanner | Detection |
IOC | Scanner | Detection |
IOC | Scanner | Detection |
IOC | Scanner | Detection |
IOC | Scanner | Detection |
IOC | Scanner | Detection |
Minimum set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.
When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.
For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.
Endpoint Security - Advanced Threat Protection:
Rule ID: 4 Use GTI file reputation to identify trusted or malicious files
Executables (Include):
*
Subrules:
Subrule Type: Files
Operations:
create
Targets (Include):
*.txd0t
Rule: 2
Executables (Include):
*
Subrules:
Subrule Type: Files
Operations:
create
Targets (Include):
*!txdot_read_me!.txt
VirusScan Enterprise - Access Protection Custom Rules:
Rule Type: File
Process to include: *
File or folder name to block: *!txdot_read_me!.txt
File actions to prevent: Create
Rule: 2
Rule Type: File
Process to include: *
File or folder name to block: *.txd0t
File actions to prevent: Create
Aggressive set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.
When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.
For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.
Endpoint Security - Dynamic Application Containment:
Reading files commonly targeted by ransomware-class malware
Modifying the Services registry location
Deleting files commonly targeted by ransomware-class malware
Rule ID: 2806 Attempt to create a hardlink to a file
Rule ID: 6010 Generic Application Hooking Protection
Rule ID: 6053 Accessing other users home directory
Rule ID: 1003 Windows Agent Shielding - Process Access
Rule ID: 6135 Unmanaged Powershell Detected
Rule ID: 1020 Windows Agent Shielding - File Access
Rule ID: 412 Double File Extension Execution
Rule ID: 1148 CMD Tool Access by a Network Aware Application