Back 
Summary
Netskope Threat Labs recently analyzed a new ransomware strain named Evil Ant. Evil Ant ransomware is a Python-based malware compiled using PyInstaller that looks to encrypt all files stored on the victim’s personal folders and external drives. This ransomware strain requires process continuity from encryption until file recovery. Rebooting, shutting down, or ending the ransomware process will make affected files unrecoverable. Based on our analysis, Evil Ant is still in its early stages and is primarily targeting consumers at present. Victims of the Evil Ant ransomware variant can also, as of this blog publishing, recover their files without payment as the decryption key is hardcoded into the malware in cleartext format.
The following is a summary of the Evil Ant ransomware execution flow:
- The Evil Ant ransomware starts by hiding the process console, and in certain variants it triggers a beeping sound upon execution.
- Evil Ant verifies if it runs with admin privileges. If not, it restarts its process and prompts the user for elevated permissions.
- Evil Ant disables the victim’s Windows Defender Antivirus and Task Manager to ensure successful encryption.
- Evil Ant collects the victim’s public IP address.
- Evil Ant then encrypts all files inside specific target folders as well as files with the .bak extension.
- After encryption, it will show a ransom note containing payment options and an input for the victim to type in the decryption key provided by the attacker.
- If the victim obtains the decryption key and uses it, it will begin the decryption of all affected files.
Analysis
Netskope Threat Labs analyzed several Evil Ant ransomware samples in the wild and observed that they are all almost identical with just a few variations. Some samples analyzed start by hiding the Python console window using Windows API ShowWindow from User32 dll.
Meanwhile, some Evil Ant variants start their infection with a beeping sound using Python’s winsound module. It sounds for a short period of time at 2,500 Hz. Since it was not used elsewhere, we assume this specific function was meant for the victim.
Evil Ant then checks if it was executed with an administrator privilege by using the IsUserAnAdmin function from the shell32 library. If it is not running with administrator privilege, it will show a message box requesting its victim to run the executable with administrator privilege. It accomplishes this by using the ShellExecute function from shell32 library to restart the executable and run it with administrator privileges. However, in doing so, it would require the user to accept the User Account Control (UAC) prompt.
Some Evil Ant variants we found have a function that attempts to disable Windows Defender prior to encrypting its target files, then re-enables it once the victim pays. It first checks if the target is using Windows and its operating system version. If it is using Windows 7, Evil Ant will attempt to disable Defender by assigning a True value to the DisableAntiSpyware registry entry using Powershell. Otherwise, it will spawn Powershell and disable real-time monitoring.
Moreover, some Evil Ant variants will disable the victim’s Task Manager, likely to avoid closing the ransomware process, making files unrecoverable. It does so by modifying the system registry key using Python’s winreg module.
Additionally, certain Evil Ant variants collect its target’s IP address and send it to the attacker via Telegram. It sends an HTTP GET request using the requests module to httpbin.org to collect the victim’s public IP address. Once collected, it will send it to the attacker using Telegram. Aside from the victim’s IP address, some variants send a message that says, “new attack is done…”
File Encryption
Evil Ant looks to encrypt files inside certain folders from the Users directory, and the root folder of an external drive. Unlike other ransomware families, it does not target specific file extensions, but looks to encrypt all files inside its target directories.
Evil Ant ransomware uses the Fernet symmetric cryptography library to encrypt its target files. It generates a key using the generate_key method and stores it in a global variable named key. It then reads the content of the file, encrypts them, then overwrites the original file with the encrypted data.
All Evil Ant samples analyzed did not store the Fernet key outside from the executable, which means the malware authors designed the Evil Ant ransomware to make files unrecoverable in case the ransomware process stops unexpectedly for any reason.
Unlike other ransomware families, Evil Ant does not attempt to delete Windows shadow copies or disable boot recovery. However, Evil Ant recursively looks for backup files with .bak extension within the C:\ drive and then encrypts it using Fernet encryption.
Once encryption is complete, some Evil Ant variants will change the victim’s wallpaper with a white background with a text saying “all your important files are encrypted with an super strong key !”
