‘Ransomware as a service’ threat targeting enterprise servers

The PureBasic-written malware is highly unconventional and has ties to well-known organisations

An unusual ransomware strain, closely linked with forms used by known threat groups, is being used in targeted attacks against enterprise production servers.

The malware has been dubbed PureLocker, because it's been written in the PureBasic programming language, and is fitted with several features that lend well to evasion. The cyber criminals behind PureLocker are also deploying a Linux variant to attack its targets' Linux infrastructure.

Several factors render PureLocker unconventional, according to a joint analysis by Intezer and IBM X-Force researchers, including the fact PureBasic is uncommon and an unusual choice. It does bring certain advantages for the attackers, though.

Vendors, for example, have difficulty generating reliable detection signatures for PureBasic strains, while the code is also highly portable between different operating systems including Windows, Linux and macOS.

Evidence also suggests PureLocker is part of a targeted and multi-stage attack that goes through a series of checks before deeming whether or not the conditions are right to strike.

This covert method includes checking for whether the machine is dated to 2019, and whether admin rights are granted. If the checks fail, the malware will exit without performing any malicious activity in order to hide its functionality.

"PureLocker is a rather unorthodox ransomware," Intezer researcher Michael Kajiloti said. "Instead of trying to infect as many victims as possible, it was designed to conceal its intentions and functionalities unless executed in the intended manner.

"This approach has worked well for the attackers who have managed to successfully use it for targeted attacks, while remaining undetected for several months."

Another unconventional feature of PureLocker is that it uses what's known as an anti-hooking technique to evade detection. Hooking is conventionally used for purposes like debugging, and can also be deployed be malicious code to make themselves invisible. This form of anti-hooking deployed by PureLocker is a known trick rarely used in ransomware.

The malware also doesn't use Windows' built-in cryptographic API functions, instead relying on a crypto library compiled in PureBasic for its specific encryption requirements.

"This type of behavior is not common in ransomware, which typically prefer to infect as many victims as possible in the hopes of gaining as much profit as possible," Kajiloti continued. "Additionally, being a DLL file designed to be executed in a very specific manner reveals this ransomware is a later-stage component of a multi-stage attack."

PureLocker has ties with the "more_eggs" backdoor malware that has been spotted being sold on the dark web by a malware as a service (MaaS) provider. It's also been used by organisations like the Cobalt Gang, FIN6, and other prominent organisations.

The fact that the code of the evasion and anti-analysis functionalities is directly copied from the "more_eggs" backdoor loader allows PureLocker to stay undetected by automated analysis systems.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Almost 70% of CISOs expect a ransomware attack
ransomware

Almost 70% of CISOs expect a ransomware attack

19 Oct 2021
Organizations warned of ransomware risk from smaller operators
ransomware

Organizations warned of ransomware risk from smaller operators

19 Oct 2021
Best ransomware removal tools
ransomware

Best ransomware removal tools

14 Oct 2021
Senator to introduce new bill to force ransomware payment disclosures
ransomware

Senator to introduce new bill to force ransomware payment disclosures

6 Oct 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Alibaba unveils custom Arm-based server chip
components

Alibaba unveils custom Arm-based server chip

19 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021