Back 
Netskope Threat Research Labs has detected new ransomware named Spider propagating in a mid-scale campaign. This ongoing campaign, identified on the 10th December, uses decoy Office documents which usually arrive as email attachments. These attachments are auto-synced to the enterprise cloud storage and collaborations apps. Netskope Threat Protection detects the decoy document as “VB:Trojan.VBA.Agent.QP” and the downloaded payload as “Trojan.GenericKD.12668779” and “Trojan.GenericKD.6290916”.
Attack Topology
The campaign’s attack vector begins with an Office document written in the Bosnian language which in all probability indicates that the threat actor is targeting or interested in the Bosnia and Herzegovina region. The decoy document we observed is shown in Figure 1.
Figure 1: Decoy Office Word document sent in the Spider Campaign.
The decoy Office document contains an obfuscated macro code, which launches the PowerShell to download the malicious payload as shown in Figure 2.
Figure 2: PowerShell downloading payloads from yourjavascript.com
The payloads are Base64 encoded and hosted on the website – ‘yourjavascript.com,’ which is a free JavaScript hosting website.
Analysis of the payloads
After downloading the payloads, the PowerShell script decodes the Base64 string and performs XOR operation with the key ‘AlberTI’ to decode the final payloads, which is later saved into executable (.exe) files. The decoded payloads named ‘dec.exe’ and ‘enc.exe’ compiled in .NET are copied to the ‘%APPDATA% /Spider’ directory.
Spider ransomware
The file ‘enc.exe’ is the ransomware encryptor, while ‘dec.exe’ works as the Decryptor.Dec.exe displays the user interface for warning message and to decrypt the files using a decryption key. Spider ransomware also copies two text files ‘files.txt’ and ‘id.txt’ respectively inside the ‘%APPDATA% /Spider’ directory along with the executables as shown in Figure 3.
Figure 3: Spider ransomware dropped files
PowerShell launches the ransomware decryptor, dec.exe with ‘spider’ argument and enc.exe file with ‘spider ktn 100’ arguments. Spider ransomware decryptor monitors the system processes and prevents opening of windows utility tools like taskmgr, procexp, msconfig, regedit, cmd, outlook, winword, excel, and msaccess as shown in Figure 4.
Figure 4: Spider ransomware anti-analysis tools checks
The payload ‘enc.exe’ then encrypts the user’s files and adds the ‘.spider’ extension as shown in Figure 5.
Figure 5: Spider ransomware encrypted files with .spider extension
Spider ransomware also maintains the list of files that it has encrypted in the ‘files.txt’ file under the Spider folder as shown in Figure 6.
Figure 6: List of files that Spider ransomware has encrypted
Spider ransomware also copies a signature file ‘5p1d3r’ to the Spider folder. The content of the file is K.T.N Cr3w, which is most likely attributed to the creators of Spider ransomware as shown in Fig