Rewterz Threat Alert – EvilQuest Wiper Uses Ransomware Cover to Steal Files From Macs
July 1, 2020Rewterz Threat Alert – TA505 Active Again – IoCs
July 1, 2020Rewterz Threat Alert – EvilQuest Wiper Uses Ransomware Cover to Steal Files From Macs
July 1, 2020Rewterz Threat Alert – TA505 Active Again – IoCs
July 1, 2020Severity
Medium
Analysis Summary
Zeppelin most commonly is distributed through phishing emails with macro-enabled documents attached, although it has also been known to spread via malvertising and RDP. Once on the system, Zeppelin leverages the same memory allocation techniques to run its payload in memory. In terms of the decryption routine, Zeppelin has evolved to load APIs onto the stack and implements additional obfuscation techniques. Both Buran and Zeppelin perform geolocation checks prior to proceeding with encryption, avoiding encrypting hosts located in Ukraine, Belarus, Kazakhstan, or Russia. For storing configuration data, a Registry key is created. The earliest versions of Zeppelin included the “Buran” keyword in the Registry key name, but have since switched to using “Zeppelin.” Zeppelin is also capable of creating persistence via a Registry Run key. Multiple instances of the executable are run, each with a different purpose. For example, one terminates processes associated with important files while also running Clipbanker to monitor the clipboard, while another is responsible for encryption of files. During encryption, both Buran and Zeppelin use add an infection marker to encrypted files. Finally, both drop a ransom note and open it using notepad.exe.
Impact
Files Encryption
Indicators of Compromise
MD5
- 15ba3a8e5b2e7b2a29b8474a29935209
- a182df5d722320a97887cabe3bde4790
SHA-256
- 1cefe918ae56ebd3c2de309efbdd3a99808c823615a11a58bf144d3d6699f69b
- 7f0dcd4b9d8881fd0c42a6d605f843c496b7ed1fc3ae3a29d0bd37e851eaadfb
SHA1
- 0101535ab30afa73e950440ad51c7fdc0b50566f
- 6311bb426a2478b982fffb2cd9b2f718b8950250
Remediation
- Block the threat indicators at their respective controls.
- Do not download email attachments coming from untrusted sources.