Genasom Ransomware operator requests remote access for fix

January 5, 2018

The SonicWall Capture Labs Threat Research Team has conducted an experimental dialog similar to our previous PayDay ransomware SonicAlert. This time we look at a ransomware threat known as Genasom where the operators use email to communicate and negotiate payment with their victims. In this case the operator wanted direct access to the infected machine in order to "fix" the problem after which a small donation is requested (according to them).

 

Infection cycle:

The Trojan uses the following icon:

 

The Trojan drops the following files onto the system:

  • %APPDATA%BC0DD974EC.exe [Detected as GAV: Genasom.RSM_2 (Trojan)]
  • _HELP_INSTRUCTION.TXT (in every directory containing encrypted files)

 

The Trojan adds the following keys to the registry:

  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun 00FF0DD974EC {original run location}
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun BC0DD974EC %APPDATA%BC0DD974EC.exe

 

_HELP_INSTRUCTION.TXT contains the following text:

Hello!Attention! All Your data was encrypted!For specific informartion, please send us an email with Your ID number:serverup@keemail.meserverup@protonmail.comserverup1@yandex.comserverup3@yandex.comann.c@iname.comPlease send email to all email addresses! We will help You as soon as possible!DECRYPT-ID-6f179b9f-7506-4075-beea-5791809b6c04 numberIMPORTANT: DO NOT USE ANY PUBLIC SOFTWARE! IT MAY DAMAGE YOUR DATA FOREVER!

 

From here the victim is left with no choice but to contact the operators via email. The following, is a short conversation we had with the operator:

 

We do not know what is behind this 'good will' scheme but would advise infected users to never take the bait. The operator will most likely cause more harm than good once granted access. This could range installing further malware and snooping on other machines within the network to launching DDoS attacks from the infected machine.

 

Sounds too good to be true and probably is.

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

  • GAV: Genasom.RSM (Trojan)
  • GAV: Genasom.RSM_2 (Trojan)
  • GAV: Genasom.A_16 (Trojan)
  • GAV: Genasom.A_17 (Trojan)
  • GAV: Genasom.A_18 (Trojan)
  • GAV: Genasom.A_19 (Trojan)