Cyborg Ransomware was found being distributed via spear-phishing email campaign which contains a fake “Windows Update” email which appears as a ‘.jpg’ file in the email attachment, but is instead a ‘.exe’ binary file. It tries to tempt users to click on the malicious attachment file in order to download and launch the ransomware payload.
After the Cyborg Ransomware performs file encryption, it will drop ransom note named “Cyborg_DECRYPT.txt” as shown in Figure 1 and change the desktop wallpaper in Figure 2 below to the victim. Furthermore, it will create a copy of itself named as ‘bot.exe’ and tries to hide its persistence from the user by setting the file attributes as ‘Hidden’.
The builder of Cyborg Ransomware was previously found hosted on Github, but it has since been taken down. However, there may still be potential for Cyborg to be used by others by creating other variants of ransomware.
Figure 1: Screenshot of the ransom note
Figure 2: Screenshot of changed desktop wallpaper
This post serves to inform our customers about detection and protection capabilities within the Carbon Black suite of products against Cyborg Ransomware.
Behavioral Summary
Cyborg Ransomware is blocked and detected by existing policies within Carbon Black products. To learn more about further ransomware behavior, detection and protection capabilities within the Carbon Black suite of products against Cyborg ransomware, you may refer to the following blog post:
In addition, CB Defense will display the malware’s overall triggered TTPs.
Remediation:
MITRE ATT&CK TIDs
| TID | Tactics | Technique |
|---|---|---|
| T1192 | Initial Access | Spearphishing attachment |
| T1158 | Defense Evasion, Persistence | Hidden Files and Directories |
| T1486 | Impact | Data Encrypted for Impact |
| T1491 | Impact | Defacement |
Indicators of Compromise (IOCs)
| Indicator | Type | Context |
|---|---|---|
| d1cabfb85197f783b5cd3fc0d8035cb5ce128c592a90835123e7fe1a286c2b79 | SHA256 | Cyborg Downloader |
| da989874b3610efe92f46f67d6a83b5f81f2ac1c90fb1133adc27b0b29c96b94 | SHA256 | Cyborg Ransomware |
| ce7a28d3f7cbcb06f484a17dcd244ac1cd126f8c557b702e011f57448045f4cf | SHA256 | Cyborg Ransomware |
| 90a6fb365e1546b7ca29eb4f08dc3f4c197835f35621e5f48651ec639725ac39 | SHA256 | Cyborg Ransomware |
| 12b92b6215b4c1dcd7ed9421ff49e540f8db08122a58fb1982ce4566b29a33d3 | SHA256 | Cyborg Ransomware |
| 076a432d5448cb7d5f7c235a77b4535b6e90ae56abc3c13e2c3c7815bab40898 | SHA256 | Cyborg Ransomware Builder |
| 7f5efdf9e9273ed21f90bb095a34140e70d6f38d074c3f0aebfa2e919d4a82cc | SHA256 | Cyborg Ransomware Builder |
| 3d5249ce45aed02472d7201f43c35263 | MD5 | Cyborg Ransomware |
| d2bbda5cc6e78a6a9baa39e2cdda4923 | MD5 | Cyborg Ransomware |
| 74bfab32741f15b9fcfb32aacffab584 | MD5 | Cyborg Ransomware |
| a9750200274a60c274312c30f57c24d1 | MD5 | Cyborg Ransomware |
| 71fc9ca31e45809d044e70617f47e95b | MD5 | Cyborg Ransomware |
| e3adcb8c860a4e0425ef1ff7a769ba6a | MD5 | Cyborg Ransomware Builder |
| 5ad1631fe97a0345cbccf8802468fa7a | MD5 | Cyborg Ransomware Builder |
The post Threat Analysis Unit (TAU) Threat Intelligence Notification: Cyborg Ransomware appeared first on VMware Carbon Black.
Article Link: https://www.carbonblack.com/2019/12/10/threat-analysis-unit-tau-threat-intelligence-notification-cyborg-ransomware/