Ransomware is gaining in popularity. It is a real threat as it seeks to find and encrypt users’ important files and then hold those files for ransom. Netskope has detected and reported on an increase in cloud apps as a delivery mechanism for ransomware, particularly in obfuscated JavaScript as well as Microsoft Word documents using macros functions.
Here we are calling your attention to a ransomware module called cuteRansomware. What makes cuteRansomware important is its use of cloud service, Google Docs, in order to transmit encryption keys and collect user information without detection. This highlights the importance of detecting malware in cloud apps, and not just in the sanctioned ones, but the unsanctioned ones as well. It also highlights the importance of anticipating such an attack by identifying where your sensitive content is in the cloud and ensuring that you have backups of those important files.
A few months ago, our research team noticed that a user with a GitHub account “aaaddress1” published source code for a ransomware module based on C# called “my-Little-Ransomware.” Since the code was publicly available, others began using it. Indeed, a security researcher at AVG spotted a malicious modified Chinese version of my-Little-Ransomware. The ransomware is also dubbed “cuteRansomware” because of the mutex name used by the original author, so in this blog we will refer it as such. Although the ransomware sample was mostly cut-and-paste from the original, the use of Google Docs to send RSA keys over the network drew our attention. Analyzing further, below is the AES code implementation in this cuteRansomware sample, which looks very similar to the my-Little-Ransomware code.