Last week, a new strain of ransomware hit dozens of targets across Germany. The categorization as ransomware is really a misnomer as, while the attackers do demand a ransom, by that time the victim’s data has already been irreversibly wiped, even if the ransom is paid. Aptly named GermanWiper, the malware doesn’t encrypt files, it just pretends to do so by overwriting their content with zeros, then adding an extension and creating a ransom note. As the file content has been overwritten and the shadow copy deleted (standard ransomware practice these days), it is impossible to recover the ‘encrypted’ files unless you have offline backup.
At the time of writing, GermanWiper is delivered via malicious email purported to be from a job applicant with resume attached. The “resume” is in the form of a ZIP attachment, which contains a LNK shortcut file that initiates GermanWiper.
Figure 1: Malicious email disguised as a job application
When the victim tries to open the attached file to view the resume, it begins an infection chain that eventually downloads and executes GermanWiper.
First, clicking the .lnk file triggers a PowerShell command that downloads an HTA (HTML application) file and executes it using Windows ‘mshta.exe’. We can see the executed command in the .lnk file properties.
The HTA file contains an obfuscated VBScript, which deobfuscates another PowerShell command by replacing characters and decoding using Base64. It then runs the PowerShell command.
The PowerShell command is slightly obfuscated with Hex, Base64 and by setting alias to known commands such as ‘IEX’. Eventually, the PowerShell script downloads the executable responsible for wiping the files from ‘http://expandingdelegation[.]top/Bewerbung-Lena-Kretschmer.exe’. The malware author even calls the application by the same name as the job application in the email.
Next, GermanWiper resolves the functions it needs in order to execute its objectives.
Figure 6: Resolving required functions
In the unpacked form of the GermanWiper executable, we can see the ransom note in plain text, bitcoin addresses base64 encoded, a wallpaper message, drives to wipe, an exclude list, delete shadows and recovery commands.
A Bitcoin address is chosen randomly from a list of ~30 bitcoin addresses. At the time of writing, three bitcoin addresses received ransom money (1,500$ which is ~0.1503 BTC), meaning at least three victims paid the ransom in vain.
The ransom note is in HTML format placed on the desktop with the name ‘<5 random characters> _Entschluesselungs_Anleitung.html’. Those five random characters match the extensions appended to the ‘encrypted’ files.
A similar ransom note and email campaign hit Germany in 2017 (gdata-ordinypt). It is unclear if the same actors are behind the GermanWiper campaign or if the authors were simply inspired by the Ordinypt campaign.
Morphisec customers are protected against GermanWiper right out of the box, without any need for an update. Morphisec’s Moving Target Defense technology prevents the attack from accessing the resources it needs to execute, so it immediately fails.
Email:
.LNK:
URLs:
Executable:
BTC addresses: (accepted payment)