News

April 13, 2017

A new ransomware called Mole was found by security researcher Brad Duncan while he was analyzing a new SPAM campaign. After examining this sample, I feel that this is probably another variant of the CryptoMix family as it has many similarities to the Revenge and CryptoShield variants.

As a note, in this article I will be referring to this infection as the Mole Ransomware as that will most likely be how the victim's refer to it. It is important to remember, though, that this ransomware is not a brand new infection, but rather a new version of the CryptoMix ransomware family.

How Victim's Become Infected with the Mole Ransomware

Mole is currently being distributed through SPAM emails that pretend to be shipping notifications. These emails state that a package could not be delivered and then displays a link to a site where additional information. An example of one of these SPAM emails can be seen below. A full list of SPAM subjects that were compiled by Brad Duncan can be found below and a list of current download links is in Brad's article.

spam email

                                                                                Rig Exploit Kit Traffic
                                                                              Source: BroadAnalysis.com

When a user clicks on the enclosed link, it will redirect to a fake Microsoft Word Online site that displays a supposedly unreadable document. This page then states that the document cannot be read in the browser and that the victim needs to download and install a plugin. You can see an example of the fake word online doc below.

fake online word doc                                                                                     Fake Online Word Document

If the user clicks on the download button, it will download a file named plugin-office.exe or pluginoffice.exe. If these files are executed, the Mole Ransomware will be installed.

How the Mole Ransomware Encrypts a Victim's Files

Once the ransomware executable is downloaded and executed on the victim's computer, it will display a fake alert that states: This fake alert is designed to coerce a victim into clicking Yes at a UAC prompt so the ransomware runs with administrative privileges. The text of this alert is:
ransomware2 fake alert                                                                                    Fake Display Color Calibration Alert

Once you press OK button in the above prompt, you will be presented with a User Account Control prompt, which asks if you wish to allow the command "C:\Windows\SysWOW64\wbem\WMIC.exe" process call create "%UserProfile%\pluginoffice.exe" to execute.

uac prompt                                                                       UAC Prompt for the Launch of Pluginoffice.exe

Once the victim clicks on Yes, the ransomware will launch again with administrative privileges and generate a unique hexadecimal ID for the victim. This ID will then be submitted to a Command & Control server, which will respond with a RSA-1024 public encryption key. This key will be used by the ransomware to encrypt the AES encryption key used to encrypt the files. This RSA key will be saved in the file %UserProfile%\AppData\Roaming\26E14BA00B70A5D0AE4EBAD33D3416B0.MOLE.

Below is the current RSA public key.
ransomware3Mole will then stop the following services:
ransomware4Then it will issue the following commands to disable the Windows startup recovery and to clear the Windows Shadow Volume Copies.
ransomware5
Finally, the infection will scan the computer for targeted files and encrypt them. When Mole encounters a targeted file it will encrypt it using AES-256 encryption, rename the file, and then append the .MOLE extension to the encrypted file. The format for a renamed file is [32_hex_chars].MOLE. For example, a file called test.jpg would be encrypted and renamed as something like 4E47636C1F31519446A78F711F4A1670.MOLE.

In each folder that Mole encrypts a file, it will also create a ransom note named INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT. Unlike most other ransomware infections, Mole does not create a HTML variant of the ransom note.

encrypted files                                                                                              Encrypted Files

When the encryption process is finished, Mole Ransomware will display the ransom note .

ransom note

                                                                                           Text Ransom Note

This ransom note contains information regarding what happened to your files, a personal identification ID, and two email addresses that can be used to contact the ransom developer for payment instructions. The current email addresses are This email address is being protected from spambots. You need JavaScript enabled to view it. and This email address is being protected from spambots. You need JavaScript enabled to view it.. Of interest is that Revenge ransomware had a contact email of This email address is being protected from spambots. You need JavaScript enabled to view it.. Coincidence?

Unfortunately, at this time there is no way to currently decrypt files encrypted by Mole for free. For those who wish to discuss this ransomware or receive support, you can always use our CryptoMix or CrypMix Ransomware Help Topic.

File Associated with the Mole Ransomware Variant:
ransomware6Mole Ransomware Hashes:
ransomware7Mole Ransomware Network Communication:
ransomware8Example Mole Ransom Note Text:
ransomware9Mole Ransomware Associated Emails:
ransomware10SPAM Email Subjects:
ransomware11News Courtesy :
 https://www.bleepingcomputer.com/news/security/mole-ransomware-distributed-through-fake-online-word-docs/