April 13, 2017
A new ransomware called Mole was found by security researcher Brad Duncan while he was analyzing a new SPAM campaign. After examining this sample, I feel that this is probably another variant of the CryptoMix family as it has many similarities to the Revenge and CryptoShield variants.
As a note, in this article I will be referring to this infection as the Mole Ransomware as that will most likely be how the victim's refer to it. It is important to remember, though, that this ransomware is not a brand new infection, but rather a new version of the CryptoMix ransomware family.
How Victim's Become Infected with the Mole Ransomware
Mole is currently being distributed through SPAM emails that pretend to be shipping notifications. These emails state that a package could not be delivered and then displays a link to a site where additional information. An example of one of these SPAM emails can be seen below. A full list of SPAM subjects that were compiled by Brad Duncan can be found below and a list of current download links is in Brad's article.
Rig Exploit Kit Traffic
When a user clicks on the enclosed link, it will redirect to a fake Microsoft Word Online site that displays a supposedly unreadable document. This page then states that the document cannot be read in the browser and that the victim needs to download and install a plugin. You can see an example of the fake word online doc below.
Fake Online Word Document
If the user clicks on the download button, it will download a file named plugin-office.exe or pluginoffice.exe. If these files are executed, the Mole Ransomware will be installed.
How the Mole Ransomware Encrypts a Victim's Files
Once the ransomware executable is downloaded and executed on the victim's computer, it will display a fake alert that states: This fake alert is designed to coerce a victim into clicking Yes at a UAC prompt so the ransomware runs with administrative privileges. The text of this alert is:
Fake Display Color Calibration Alert
Once you press OK button in the above prompt, you will be presented with a User Account Control prompt, which asks if you wish to allow the command "C:\Windows\SysWOW64\wbem\WMIC.exe" process call create "%UserProfile%\pluginoffice.exe" to execute.
UAC Prompt for the Launch of Pluginoffice.exe
Once the victim clicks on Yes, the ransomware will launch again with administrative privileges and generate a unique hexadecimal ID for the victim. This ID will then be submitted to a Command & Control server, which will respond with a RSA-1024 public encryption key. This key will be used by the ransomware to encrypt the AES encryption key used to encrypt the files. This RSA key will be saved in the file %UserProfile%\AppData\Roaming\26E14BA00B70A5D0AE4EBAD33D3416B0.MOLE.
Below is the current RSA public key.
Mole will then stop the following services:
Then it will issue the following commands to disable the Windows startup recovery and to clear the Windows Shadow Volume Copies.
Finally, the infection will scan the computer for targeted files and encrypt them. When Mole encounters a targeted file it will encrypt it using AES-256 encryption, rename the file, and then append the .MOLE extension to the encrypted file. The format for a renamed file is [32_hex_chars].MOLE. For example, a file called test.jpg would be encrypted and renamed as something like 4E47636C1F31519446A78F711F4A1670.MOLE.
In each folder that Mole encrypts a file, it will also create a ransom note named INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT. Unlike most other ransomware infections, Mole does not create a HTML variant of the ransom note.
When the encryption process is finished, Mole Ransomware will display the ransom note .
Text Ransom Note
Unfortunately, at this time there is no way to currently decrypt files encrypted by Mole for free. For those who wish to discuss this ransomware or receive support, you can always use our CryptoMix or CrypMix Ransomware Help Topic.
File Associated with the Mole Ransomware Variant:
Mole Ransomware Hashes:
Mole Ransomware Network Communication:
Example Mole Ransom Note Text:
Mole Ransomware Associated Emails:
SPAM Email Subjects:
News Courtesy : https://www.bleepingcomputer.com/news/security/mole-ransomware-distributed-through-fake-online-word-docs/