Rewterz Threat Alert – A Threat from the Shadows of LokiLocker, BlackBit Ransomware Being Distributed In Korea – Active IOCs

Severity

High

Analysis Summary

According to researchers, BlackBit ransomware is being distributed in Korea. It is identified as a variant of LokiLocker ransomware and operates on the Ransomware-as-a-Service (RaaS) model. The source code analysis of BlackBit suggests that it is a copy of LokiLocker with cosmetic changes such as icons, name, and color scheme. These modifications may have been made to differentiate BlackBit from its original counterpart and potentially confuse security researchers.

Here is a summary of the common traits between LokiLocker and BlackBit ransomware: 

• File Disguise: LokiLocker and BlackBit ransomware both disguise themselves as svchost.exe files. This technique aims to trick users into executing the ransomware, thinking it is a legitimate system process.

• Obfuscation: Both ransomware strains utilize the same obfuscation tool, .NET Reactor, to make the analysis and reverse-engineering of their code more challenging. Obfuscation helps protect the malware from detection and analysis by security researchers.
• Malware Persistence: LokiLocker and BlackBit register themselves to the task scheduler and the Windows registry to achieve persistence. This means that even if the infected system is restarted, the ransomware will automatically execute again, ensuring a prolonged presence on the compromised system.
• Ransom Note Generation: Upon successful infection, both ransomware variants generate a ransom note. In the case of LokiLocker, the ransom note is named “Restore-My-Files.txt” and is created in each infected folder path. The design and content of the ransom notes resemble those used by BlackBit ransomware.

• Data Encryption: LokiLocker and BlackBit ransomware both employ data encryption techniques. They encrypt the victim’s files, making them inaccessible until a ransom payment is made and a decryption key is provided by the attackers.
• Anti-Recovery Measures: Both ransomware strains engage in activities to impede file recovery efforts. They delete volume shadow copies, which are backup snapshots created by the operating system, to prevent users from restoring their files through these means.
• Detection Evasion: LokiLocker and BlackBit ransomware perform actions aimed at obstructing detection and information leakage. These actions can include disabling security software, terminating processes related to backup and recovery tools, and attempting to evade network monitoring systems.

These similarities suggest a strong connection between LokiLocker and BlackBit ransomware, indicating a potential relationship between the two or the possibility that LokiLocker was directly inspired by BlackBit. Such observations highlight the need for robust cybersecurity measures to protect against ransomware attacks and emphasize the importance of staying vigilant and implementing security best practices.

Impact

• File Encryption
• Deletion Of System Backup

Indicators of Compromise

MD5

• d03823a205919b6927f3fa3164be5ac5

SHA-256

• c9b1665e58fe0bd5a47bac14d7f262fcb21a90775c97bd778288c21eaac7435b

SHA-1

• 409181132564166a62ee867321ebc07089e49085

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets