Virus Alert: Maze Ransomware
Type: Ransomware
Severity: - High
The Maze ransomware was initially discovered in May 2019 and recently Cyber
security community has seen a rise in Maze ransomware activities. Maze
ransomware is often delivered via emails or exploit kits such as Fallout
and Spelevo. Fallout and Spelevo exploit kits takes advantage of flaws in
Adobe Flash Player and Microsoft Windows (CVE-2018-8174, CVE-2018-15982,
and CVE-2018-4878). In addition to these, Maze ransomware uses Remote
Desktop Protocol (RDP) and malicious advertisements as its attack vectors.
Maze ransomware uses 2048 bit Rivest-Shamir-Adleman (RSA) and ChaCha20
stream cipher encryption to encrypt files. It appends arbitrary extensions
to the files during the encryption process. The Maze ransomware executes a
“process killer” before starting the encryption processes. Ransomware
terminates target processes mainly debuggers, text editors, and programming
IDEs, databases and languages running on the infected system. Maze
ransomware deletes Shadow Volume Copies twice (pre and post encryption) to
ensure that recovery is not possible. It then changes the user's desktop
wallpaper to a message about the encrypted files and the file name of the
dropped ransom note. The malware tries to make connections to IP addresses
that have been crypted in the binary to send information about the infected
machine.
The ransom note asks the victim to contact the threat actor by email for
the decryption key. An interesting feature of this ransomware is that it
says the ransom amount will be different depending on the type of device.
This is uncommon in this ransomware. Maze operators have used the following
labels to indicate the user's computer type in the wallpaper message:
• Standalone server
• Server in corporate network
• Workstation in corporate network
• Home computer
• Primary domain controller
• Backup server
• Very valuable for you
Another uncanny characteristic of Maze ransomware has been post compromise
cyber extortion in lieu of stolen data. Failing to pay ransom Maze
operators release stolen data on the Internet.
Indicators of Compromise:
Hashes
SHA256
dee863ffa251717b8e56a96e2f9f0b41b09897d3c7cb2e8159fcb0ac0783611b
SHA1
31c3f7b523e1e4060330958e28882227765c3c5e
SHA256
6345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586ddi
SHA1
c5938ec75e5b655be84eb94d73adecOf63fbce16
SHA256
5a900fd26a4ece38de5ca319b5893f96c7e9e2450dbac796c12f85b99238ec18
SHA1
1e994b5ac039a1c7612bab93248532bf3ed7e6de
Network IOC’s
Mazedecrypt[.]top
conbase[.]top
mazedecrypt[.]top
condurises[.]xyz
emplementriaton[.]xyz
fantimit[.]xyz
91[.]218.114.11
91[.]218.114.25
91[.]218.114.26