A look at the latest Snatch Ransomware

This week, the Sonicwall Capture Labs Research team analyzed the latest Snatch ransomware. Snatch operates as a ransomware-as-a-service (RaaS), a business model where the malware authors lease out the ransomware program to affiliates who then launch the attacks.

Infection Cycle:

The malware file  arrives as an executable  using a random name such as:

• rljybc.exe

This ransomware is written in Go language and is apparent in the many references to Go packages in its strings.

Upon execution it creates multiple copies of the same batch file into the %temp% directory:

Simultaneously it also writes a randomly named file with a .dll extension that appears to be a library file.

But upon careful inspection, it actually was a log file of its execution showing files it had accessed and created.

The batch file created is used to run commands to delete shadow copies and to disable certain services that are related to Antivirus, back up software, database, email among many others.

It appends “.lqepjhgjczo” extension to all files it encrypts and adds the ransomware note to every directory in the system.

The ransom note only lists email addresses on how to reach the malware authors and no amount of ransom is mentioned. Presumably, this amount may vary depending on their victim and how disruptive the attack would cost a business or an organization.

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: Snatch.RSM_13  (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.