Retour 
Executive Summary
Netskope Threat Research Labs recently detected several strains of encrypted files across several cloud instances with the infamous LockerGoga Ransomware. The Ransomware was shared among users in multiple cloud instances of Microsoft OneDrive and Box, enabling the ransomware to fan-out within the organizations.
This blog provides an overview of the LockerGoga ransomware samples we discovered, including some key differences between these new samples and the ones that were discovered earlier this year. We also reiterate the two different levels at which we can prevent the LockerGoga ransomware from spreading within an organization.
Netskope Detection
Netskope detects LockerGoga at two levels: Our threat protection engine detects the delivery vehicles and payloads, and our ransomware encrypted file detection and recovery engine detects and enables the rapid recovery of files encrypted by ransomware.
Netskope threat protection detects the samples LockerGoga Ransomware as “Win32.Trojan.Lockergoga” and the encrypted files as “Gen.Ransom.Encrypted.File.ns”. The screenshot in Figure 1 shows two files, shared via Box, that were encrypted by the LockerGoga Ransomware. The encrypted files can be automatically restored to their original, unencrypted state.
Figure 1: Ransomware detection feature by Netskope.
Overview
Initially, the LockerGoga Ransomware was archived in a zip file and shared to several cloud users. When it executes:
- The ransomware encrypts files on the user’s machine and sync folders.
- The encrypted versions of the files get synced with the cloud app, replacing the original files with the encrypted one.
LockerGoga Ransomware
LockerGoga is ransomware that came into the picture in January 2019 and appears to still be under active development. It has been used in targeted attacks against industrial and manufacturing industries. Its first high-profile target was the French engineering consulting firm Altran on 21 January 2019. It has more recently been used against the Norwegian aluminum manufacturer Norsk Hydro on 19 March 2019, forcing some of the company’s aluminum plants to switch to manual operations.
Analysis of LockerGoga Ransomware
Our analysis focuses on a zip archive containing the LockerGoga Ransomware, with the hash 48a6f9882e83c180c8b34a098fa42a0b.
The executable contained in the archive was digitally signed, as shown in Figure 2.
Figure 2: Certificate used by LockerGoga Ransomware
LockerGoga uses boost c++ library to interact with the filesystem, functions like “boost::filesystem::rename” instead of the traditional Windows APIs. This complicates the analysis, as the boost library makes heavy usage of undocumented Windows APIs internally. An excerpt of the boost library functions used is shown in Figure 3.
