{"id":95044,"date":"2019-04-29T10:10:06","date_gmt":"2019-04-29T17:10:06","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=95044"},"modified":"2024-02-18T19:21:46","modified_gmt":"2024-02-19T03:21:46","slug":"lockergoga-ransomware-family-used-in-targeted-attacks","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/lockergoga-ransomware-family-used-in-targeted-attacks\/","title":{"rendered":"LockerGoga Ransomware Family Used in Targeted Attacks"},"content":{"rendered":"

Co-authored by Marc RiveroLopez.<\/p>\n

Initial discovery<\/h2>\n

Once again, we have seen a significant new ransomware family in the news. LockerGoga, which adds new features to the tried and true formula of encrypting victims\u2019 files and asking for payment to decrypt them, has gained notoriety for the targets it has affected.<\/p>\n

In this blog, we will look at the findings of the McAfee ATR team following analysis of several different samples. We will describe how this new ransomware works and detail how enterprises can protect themselves from this threat.<\/p>\n

Technical analysis<\/h2>\n

LockerGoga is a ransomware that exhibits some interesting behaviors we want to highlight. Based on our research, and compared with other families, it has a few unique functions and capabilities that are rare compared to other ransomware families that have similar objectives and\/or targeted sectors in their campaigns.<\/p>\n

In order to uncover its capabilities, we analyzed all the samples we found, discovering similarities between them, as well as how the development lifecycle adds or modifies different features in the code to evolve the ransomware in a more professional tool used by the group behind it.<\/p>\n

One of the main differences between LockerGoga and other ransomware families is the ability to spawn different processes in order to accelerate the file encryption in the system:<\/p>\n

\"\"<\/p>\n

Like other types of malware, LockerGoga will use all the available CPU resources in the system, as we discovered on our machines:<\/p>\n

\"\"<\/p>\n

Most of the LockerGoga samples work the same way but we observed how they added and removed certain types of functionality during their development lifecycle.<\/p>\n

The ransomware needs be executed from a privileged account.<\/p>\n

LockerGoga works in a master\/slave configuration. The malware begins its infection on an endpoint by installing a copy of itself on the %TEMP% folder.<\/p>\n

\"\"<\/p>\n

After being copied, it will start a new process with the -m parameter.<\/p>\n

The master process runs with the -m parameter and is responsible for creating the list of files to encrypt and spawning the slaves.<\/p>\n

The slave processes will be executed with a different set of parameters as shown below. Each slave process will encrypt only a small number of files, to avoid heuristic detections available in endpoint security products. The list of files to encrypt is taken from the master process via IPC, an interface used to share data between applications in Microsoft Windows. The communication is done through IPC using a mapped section named SM-<name of binary>.<\/p>\n

Here is the IPC technique used by LockerGoga:<\/p>\n