StopCrypt, the most common ransomware family of 2023, has a new variant leveraging more advanced evasion tactics.
StopCrypt, also known as STOP/DJVU, surpassed the LockBit ransomware family in detections in 2023, according to Trend Micro's 2023 Annual Cybersecurity Report published last week.
STOP typically targets smaller targets with an average ransom payment size of $619 in the first half of 2023, according to a mid-year report by Chainalysis.
SonicWall reported Tuesday that a new StopCrypt variant employes several evasion tactics in a multi-stage shellcode deployment process, including a long delay loop, dynamic API resolution and process hollowing, or the replacement of code in a legitimate executable to malicious code.
The StopCrypt variant studied by SonicWall's Capture Labs begins its stealth mission by copying the same data to a location more than 65 million times in a delay loop likely intended to dodge time-sensitive anti-virus mechanisms such as sandboxing.
It then employs multiple stages of dynamic API resolution - calling APIs at runtime rather than linking them directly.
This prevents anti-virus detection of artifacts created by direct API calls from static links in the malware code.
After taking a snapshot of the current processes using CreateToolHelp32Snapshot, extracting information using Module32First, and calling VirtualAlloc to allocate memory with read, write and execute permissions, the malware enters a second stage in which it dynamically calls additional APIs to perform process hollowing.
Ntdll NtWriteVirtualMemory is used to write malicious code into a suspended process created with kernel32 CreateProcessA. When the suspended process is resumed, the final ransomware payload launches icacls.
Exe to modify access control lists to prevent the ability to modify or delete a new directory and files created by StopCrypt.
The STOP variant described by SonicWall bears similarities to a variant discovered by PCrisk researchers last year, which was originally submitted through VirusTotal.
This Cyber News was published on packetstormsecurity.com. Publication date: Mon, 18 Mar 2024 14:43:07 +0000