Tron Ransomware - Infecting only Non-Russian Victims!

Overview

The LMNTRIX Threat Intelligence Platform has recently found a new variant of Tron, a ransomware that targets non-Russians, under the microscope.  This sample underwent analysis:

File Hash (SHA-256): fb45f10c886974e29a57673769c0bc4e53fcaf063e172e38d92eea85bf570aff

File Size: 87.5 KB

File creation- TimeDateStamp: (Thu Apr 12 16:54:17 2018)

Infection

 

Figure 1 VT result for Tron Ransomware

Analysis of the Ransomware sample

Our researcher team checked the file’s PE details it found to be compiled using .Net.

 

Figure 2 Compiled using .Net

We listed the following malicious indicator in the sample as shown in the screenshot:

 

Figure 3 Malicious Indicator

Blacklisted strings count is 38 and the original file name is Tron.exe. Our researcher dissected the sample and analyse the code.

Threat Indicators                                               

When we dissected the codes, we found the file locations in the victim’s system that would be targeted by the ransomware.

 

Figure 4 Targeted folders

When we executed the file, it encrypted the files in all those folders listed above. And it added the file extension as ‘Tron’ after encryption:

 

Figure 5 Tron Extension added after encryption



 

Figure 6 Ransom notes and Payment methods

Not Russia Then Exit

In this code, we found that this ransomware sense the geo location and if it detects the location as Russia then it exits.

 

Figure 7 If Russia then exit

Threat Indicators

IOC details:



File Hashes:

SHA 256: fb45f10c886974e29a57673769c0bc4e53fcaf063e172e38d92eea85bf570aff

SHA 256: 41b9d94f13dd2b2d9d3b01df692f1837731a932e2ae938cccf34905064f6f30f



File extension added by this variant of ransomware:

‘.tron’



Conclusion

We suspect that we will continue to see the rise of geo-targeted ransomware, which in part, has the advantage for threat actors of presumably limiting local law enforcement concerns about their activities since there targets are outside of their own geographic jurisdictions.

 


On 2018-04-19

Privacy Statement | Terms of Use