Do the twist: Vortex ransomware spins and scrambles victim data

Earlier this year, we witnessed a new ransomware variant, Vortex, evolve from a previous strain, Polski. The most recent strain was developed using a freeware encryption and decryption tool called AESxWin, which was modified to give Vortex its malicious nature. Both primarily target Polish users.

Vortex has some very unorthodox characteristics, so let’s take a closer look.

Delivery

Vortex is not spread through the usual spam email campaigns, instead its authors prefer to use RAT (Remote Access Trojans) as the delivery tool. The specific agent downloaders were JS/VJworm (JavaScript) variants.

Figure 1 – Delivery representation

Infection

Static analysis:

MD5: 91A07550E5CA2C977F50406F07126AC8

Figure 1 Version information

The version information lists AESxWin as both the product name and original file name. AESxWin is a free tool available from github and is used for encrypting and decrypting files. The image below shows that even the file’s icon is the same:

Figure 2 – File Icons

Both files are compiled with dotnet compiler and the target framework is .net 4.5.  

Code analysis (comparing AESxWin file and Vortex ransomware file)

The below image illustrates some of the differences between the legitimate AESxWin file and the Vortex ransomware – the upper portion contains the legitimate file, and the ransomware lies in the lower. 

 Figure 3 – Comparison

The malicious, modified version contains extra routines like AESxWinAuto, Form1, pro and Reg. Examining these routines illustrates the behaviours of the ransomware variant:

AESxWinAuto:

Each of these strings can be expanded, showing the targeted file format. For image_ext, we found the following extensions:

For video_ext, we found the following target extensions for video files:

For audio_ext, we found the following target extensions for audio files:

For document_ext, we found the following target extensions for document files:

For compressed_ext, we found the following target extensions for compressed folders:

For code_ext we found the following target extensions for scripts and web page files:

We then found a startup entry registry function:

This code includes an autostart entry to give the malware persistence. The ‘Get’ function notes the registry key name and looks for its presence. The ‘Set’ function appends another class, ‘Reg’, which registers the malware file location in the value entry. We then checked the ‘Reg’ class: 

The above three strings can be expanded, but we’ll just focus on the important points.

String Read(string KeyName) looks for the currentuser key in the registry and further seeks the subkey “SOFTWARE\\AESxWin”. Bool Write (string KeyName, object Value), creates the subkey “SOFTWARE\\AESxWin”, if the String Read function fails to find its subkey.

RegisterInStartup does the autostart work by adding the malware’s physical location to the value of the ‘Run’ registry entry. This is the Reg class’ primary function.

Other interesting functions

There are other interesting functions and codes to be examined. The following code ignores listed paths (locations) in the system. 

The paths Vortex ignores are Application Data and Common Files. It is clear this variant wants to focus on specific locations and ignores those without important documents. 

This code looks for documents, pictures, videos and recent files – all of which are important locations for any user. 

Auto encrypt is then enabled, started by the button: 

After the encryption, the ransomware appends the “.ZABLOKOWANE” extension at the end of all encrypted files. A log of these encrypted files is stored in a .log file in the folder:

C:\ProgramData\Keyboard\

The following code refers to the logging details and the above-mentioned location.

AESxWinAuto.LogPath = “C:\\ProgramData\\Keyboard”;

bool flag = !Directory.Exists(AESxWinAuto.LogPath);

if (flag)

{

Directory.CreateDirectory(AESxWinAuto.LogPath);

}

In the log file, we found the string format:     

Command and Control

C2: https://asuspl.ml/widwdp/

C2: https://taniepilapl/mij/

Vortex gathers the victim’s IP address with the public api: “api.ipify.org”

 We found the email address information in the above code. Password generation looks as though it’s done with the help of an api – see the following code:

The site – asuspl.ml/pass – is used for a password generating api, similar to how api.ipify is used to gather the infected user’s IP address.

The above shows command and control details inside the code.

IOC details

Url:

Asuspl.ml/pass

Api.ipify.org

taniepilapl/mij

Email address:

3nigma@firemail.cc

3nigma@0.pl

File name:

The file name ‘AESxWin.exe’ is in a grey area in this case, because of the freeware encryption tool.

Registry:

SOFTWARE\\AESxWin

Run registry entry with value as AESxWin and physical location of the target file.

Extension: .ZABLOKOWANE

PDB: C:\c1\AESxWin-master\AESxWin-master\AESxWin\obj\Debug\AESxWin.pdb

Conclusion

While this ransomware variant was clearly written with only Polish victims in mind, it goes to show how clever malware authors can be. Not only does Vortex use unorthodox propagation methods, it also piggy backs off the hard work of a legitimate software developer. 

Currently this ransomware will not infect Windows XP users, because it requires .Net framework 4.5 or higher to run, similar to the freeware tool. Later Windows versions with .Net framework 4.5 can allow the ransomware to execute and infect the system.