New AstraLocker Version Phishing Campaign

Context

On June 28, 2022, ReversingLABS researchers reported a phishing campaign using malicious Microsoft Office files to distribute the new 2.0 version of the AstraLocker ransomware. Researchers assess that the threat actors behind the campaign likely obtained the AstraLocker 2.0 code from the Babuk leak in September of 2021, based on shared code and campaign markers. The cryptocurrency wallet addresses used in the campaign are associated with the Chaos ransomware gang.

Technical Details

AstraLocker is a fork of the Babuk ransomware and first appeared in 2021. Version 2.0 first appeared in March of 2022. The ransomware is delivered in phishing emails via malicious Microsoft Word documents. The payload is stored in an object linking and embedding (.OLE) object that is only activated when the victim double-clicks on the executable icon inside the malicious documents.

The new version of AstraLocker uses the outdated SafeEngine Shielden v2.4.0.0 protector, which complicates reverse engineering efforts. The new version also uses sophisticated tactics such as:

• Checking if the host is a virtual machine (VM)
• Checking running processes to determine if the environment is an analysis sandbox
• Checking names of open windows to determine if malware analysis tools are running
• Hiding threads from debugging tools by using the argument HideFromDebugger
• Stopping multiple backup and anti-malware services
• Killing multiple processes that could interfere with encryption
• Deleting volume shadow copies
• Emptying the recycle bin
• Enumerating and mounting all drives and network shares
• Encrypting files using Curve25519, one of the fastest elliptic curve cryptography (ECC) curves

Impact Analysis

Researchers assessed that while the ransomware tool itself was relatively sophisticated, the campaign is not technically sophisticated. The campaign delivered the ransomware immediately whenever victims clicked the attachment. In most sophisticated ransomware campaigns, attackers wait until later in the compromise chain to deliver the payload to allow time for deeper penetration into networks and reconnaissance into targeted networks. Executing the ransomware payload also took multiple manual clicks by the victim. Requiring so much manual activity from the victim creates numerous opportunities for the infection process to be interrupted or second-guessed by victims.

IOCs

ReversingLabs researchers provided the following indicators of compromise (IOCs) for the campaign: