Rewterz Threat Alert – Maze Ransomware – IoCs

Severity

High

Analysis Summary

A few weeks ago, Maze Ransomware targeted an Algerian oil company and posted some of their data online as a part of victim shaming. Last week, a large enterprise-class, managed service provider (Cognizant) fell victim to a Maze ransomware attack. This particular campaign includes a signed DLL payload (kepstl32.dll). Upon infection, the trojan will drop a customized desktop image into %temp%, and then traverse the disk, encrypting supported file-types. A copy of the ransom instructions “DECRYPT-FILES.txt” is dropped into each folder containing encrypted files. As with previous variants of Maze, the trojan will attempt to inhibit recovery by deleting shadow copies via WMIC.exe (wmic.exe shadowcopy delete). Given below are the IoCs.

Impact

• Files Encryption
• Confidentiality breach

Indicators of Compromise

MD5

• a0dc59b0f4fdf6d4656946865433bcce
• fba4cbb7167176990d5a8d24e9505f71
• c043c153237b334df2f2934f7640e802
• 910aa49813ee4cc7e4fa0074db5e454a

SHA-256

• 9d86beb9d4b07dec9db6a692362ac3fce2275065194a3bda739fe1d1f4d9afc7
• 5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353
• fb5de69b222d81fea2f4b08fd5af612faf24b9e75698ac331af066fbc360a30a
• 4218214f32f946a02b7a7bebe3059af3dd87bcd130c0469aeb21b58299e2ef9a

SHA1

• c10fd0163c42f1149d5dcfb44e31b53a4fe6c6c9
• aa6cd2698d4f9a7fa99f5807f4b6695a0bfd0124
• d5ef91b849122109615007329ec6548830f13bfc
• 45831987fabeb7b32c70f662be8cb24e2efef1dc

Remediation

• Block the threat indicators at their respective controls.
• Keep all software and systems updated to latest versions.
• Do not download any untrusted files from email attachments or the internet.