March 16, 2017
A new CryptoMix, or CryptFile2, variant called Revenge has been discovered by Broad Analysis that is being distributed via the RIG exploit kit. This variant contains many similarities to its predecessor CryptoShield, which is another CryptoMix variant, but includes some minor changes that are described below.
As a note, in this article I will be referring to this infection as the Revenge Ransomware as that will most likely be how the victim's refer to it. It is important to remember, though, that this ransomware is not a brand new infection, but rather a new version of the CryptoMix ransomware family.
How Victim's Become Infected with the Revenge Ransomware
Rig Exploit Kit Traffic
How the Revenge Ransomware Encrypts a Victim's Files
Once the ransomware executable is downloaded and executed on the victim's computer, it will generate a unique 16 hexadecimal character ID for the victim. It will then terminate the following database related processes so it has full access to the databases in order to encrypt them:
Revenge will then proceed to scan the computer for targeted files and encrypt them. While Revenge's predecessor targeted 454 extensions for encryption, Revenge targets 1,237 extensions, which can be seen at the end of the article.
When Revenge encounters a targeted file it will encrypt it using AES-256 encryption, encrypt the filename, and then append the .REVENGE extension to the encrypted file. The format for a renamed file is [16_hex_char_vicimt_id][16_hex_char_encrypted_filename][unknown_8_hex_char_string][8_char_encrypted_filename].REVENGE. For example, a file called test.jpg would be encrypted and renamed as something like ABCDEF0123456789B7BC7311B474CAFD.REVENGE.
The AES encryption key used to encrypt the victim's files is then encrypted using a embedded RSA-1024 public key that only the ransomware developer has the ability to decrypt. The current public RSA key is:
In each folder that Revenge encrypts a file, it will also create a ransom note named # !!!HELP_FILE!!! #.txt. Unlike previous versions of CryptoMix, this variant does not create a HTML version of the ransom note as well.
During the infection process, Revenge will issue the following commands to disable the Windows startup recovery and to clear the Windows Shadow Volume Copies as shown below.
Revenge will also display a fake alert that states:
Like the fake alert in CryptoShield, the broken English in the Revenge alert should give victim's a hint that this alert is not legitimate.
Fake Explorer.exe Alert
Once you press Continue in the above prompt, you will be presented with a User Account Control prompt, which asks if you wish to allow the command "C:\Windows\SysWOW64\wbem\WMIC.exe" process call create "%UserProfile%\a1x[r65r.exe" to execute. This explains why the previous alert was being shown; to convince a victim that they should click on the Yes button in the below UAC prompt so that ransomware is executed with administrative privileges.
UAC Prompt for the Launch of the SmartScreen.exe Executable
Finally, the Revenge Ransomware will display a ransom note called # !!!HELP_FILE!!! #.txt.
Text Ransom Note
Unfortunately, at this time there is no way to currently decrypt files encrypted by Revenge for free. For those who wish to discuss this ransomware or receive support, you can always use our CryptoMix or CrypMix Ransomware Help Topic.
File Associated with the Revenge Ransomware Variant:
Revenge Ransomware Hashes:
Revenge Ransomware Network Communication:
Example Revenge Ransom Note Text:
Revenge Ransomware Associated Emails:
Extensions Targeted by Revenge:
News Courtesy : https://www.bleepingcomputer.com/news/security/revenge-ransomware-a-cryptomix-variant-being-distributed-by-rig-exploit-kit/