Atrás 
Executive Summary
Netskope Threat Research Labs recently detected several strains of encrypted files across several cloud instances with the infamous LockerGoga Ransomware. The Ransomware was shared among users in multiple cloud instances of Microsoft OneDrive and Box, enabling the ransomware to fan-out within the organizations.
This blog provides an overview of the LockerGoga ransomware samples we discovered, including some key differences between these new samples and the ones that were discovered earlier this year. We also reiterate the two different levels at which we can prevent the LockerGoga ransomware from spreading within an organization.
Netskope Detection
Netskope detects LockerGoga at two levels: Our threat protection engine detects the delivery vehicles and payloads, and our ransomware encrypted file detection and recovery engine detects and enables the rapid recovery of files encrypted by ransomware.
Netskope threat protection detects the samples LockerGoga Ransomware as “Win32.Trojan.Lockergoga” and the encrypted files as “Gen.Ransom.Encrypted.File.ns”. The screenshot in Figure 1 shows two files, shared via Box, that were encrypted by the LockerGoga Ransomware. The encrypted files can be automatically restored to their original, unencrypted state.
Figure 1: Ransomware detection feature by Netskope.
Overview
Initially, the LockerGoga Ransomware was archived in a zip file and shared to several cloud users. When it executes:
- The ransomware encrypts files on the user’s machine and sync folders.
- The encrypted versions of the files get synced with the cloud app, replacing the original files with the encrypted one.
LockerGoga Ransomware
LockerGoga is ransomware that came into the picture in January 2019 and appears to still be under active development. It has been used in targeted attacks against industrial and manufacturing industries. Its first high-profile target was the French engineering consulting firm Altran on 21 January 2019. It has more recently been used against the Norwegian aluminum manufacturer Norsk Hydro on 19 March 2019, forcing some of the company’s aluminum plants to switch to manual operations.
Analysis of LockerGoga Ransomware
Our analysis focuses on a zip archive containing the LockerGoga Ransomware, with the hash 48a6f9882e83c180c8b34a098fa42a0b.
The executable contained in the archive was digitally signed, as shown in Figure 2.
Figure 2: Certificate used by LockerGoga Ransomware
LockerGoga uses boost c++ library to interact with the filesystem, functions like “boost::filesystem::rename” instead of the traditional Windows APIs. This complicates the analysis, as the boost library makes heavy usage of undocumented Windows APIs internally. An excerpt of the boost library functions used is shown in Figure 3.
Figure 3: Boost libraries used by sample
The execution flow of LockerGoga Ransomware is in the flow chart as shown in Figure 4. On execution, LockerGoga “sample.exe” moves itself in “%temp%” folder. It then executes itself with command line argument -m (master process). After execution, “tgytutrc7995.exe” is a master process which creates multiple child processes with command line argument -s (slave process) and -i (interprocess communication).
Multiple processes with argument “-i SM-tgytutrc -s” are slave processes for encryption. The processes use a mutex named “MX-tgytutrc” for interprocess communication. Logoff.exe an net.exe are called to make the changes described in the next section.
Figure 4: Flow chart of LockerGoga Ransomware
Master Process of LockerGoga Ransomware
The master process logs off all current sessions and changes the password of Administrative accounts to “HuHuHUHoHo283283@dJD”. After this, multiple child processes with “-i SM-tgytutrc -s” command line argument are created. The switches stand for
- “-s” → slave process
- “-i” → interprocess communication
- “MX-tgytutrc” → Mutex to use of interprocess communication.
LockerGoga Ransomware Encryption
LockerGoga uses the Cryptopp C++ libraries to encrypt the files with AES algorithm and encrypts 30 types files with extensions as shown in Figure 5.
