In this Malware Analysis Spotlight , we analyze the Berserker variant of Hentai Oniichan Ransomware .
We’ve observed at least two different variants of Hentai Oniichan Ransomware in-the-wild, King Engine, and Berserker. What we found interesting in our analysis of the Berserker variant is its attempts to make recovery difficult by deleting backup files, uncommon with traditional ransomware.
View the VMRay Analyzer Report for Hentai Oniichan Ransomware (Berserker Variant)
Hentai Oniichan Ransomware (Berserker Variant) Analysis
As a first step, Berserker injects code into a newly created process of the sample.
Initially, Berserker starts enumerating running processes in an attempt to terminate all processes that match its internal list (Figure 1, Appendix).
After it finishes with process enumeration, Berserker tries to shutdown services responsible for backups (see Appendix for a complete list), monitoring, or anything that could prevent it from encrypting files (Figure 2).
Berserker executes multiple Powershell commands during its execution. To make sure this is possible it tries to adjust certain settings and preferences (Figure 3). Following that, it also adjusts preferences for Windows Defender like disabling real-time monitoring and behavior monitoring.
The ransomware transmits the user name, computer name, and client key to an external server by sending an email. It uses Powershell to construct and send it via Gmail’s SMTP server, whereby the script contains the plain login credentials (Figure 4.1 & 4.2).
Berserker makes recovery more difficult by deleting backup files. Usually, ransomware targets the recovery feature provided by Microsoft Windows. They disable the recovery mode, delete shadow copies, and the backup catalog.
While most ransomware stops at this point, Berserker goes the extra length by attempting to delete potential backup and disk image files. It searches for the extensions .vhd, .bac, .bak, .wbcat, .bkf, .set, .win, .dsk and for files within directories called “Backup” or “backup” in the root directory of the filesystem (Figure 5). Typically, ransomware encrypts backups and doesn’t remove them, except for Shadow Copies. By removing the backups instead of encrypting the Berserker is potentially faster but carries the risk of deleting something they can’t restore. In the case of virtual disk files used as additional data storage and not for backups, the data is lost.
Recently, we have seen another approach used by RegretLocker which also targets virtual disk image files. Instead of deleting them, the RegretLocker ransomware mounts the image files and encrypts the data inside.
Cyber Security Side-Note
Since ransomware targets files used for backups, it is advisable to not host those files on the same system that is being backed-up.
Encryption
Berserker is written in C++ and is statically compiled against the library Crypto++.
For the encryption, Berserker iterates over the whole hard drive using depth-first search. It uses block-lists as a filtering mechanism. If a folder name or file extension is on its internal block-lists (see Appendix for a complete list) the file or directory is skipped. If the file is not on the list it is encrypted later on and gets the extension .HOR.
The ransomware also doesn’t forget to deliver its ransom note. It drops two types of notes: one that is dropped on the desktop warning the user to not kill the running process (Figure 6).
The second ransom note is used as a replacement for the desktop wallpaper where the actual ransom demand and contact information is written (Figure 7).
Conclusion
In contrast to most ransomware, Berserker targets additional files and directories to make recovery more complicated. To do so, it heavily relies on Powershell and cmd. For example, Windows Defender mitigation, recovery feature, and email transmissions are handled by using Powershell.
Furthermore, we have found several log messages referenced in the code and during the dynamic analysis, the sample creates empty log files. This could indicate that the malware is still under development.
With VMRay’s unique dynamic analysis technology and the intelligent monitoring system at the hypervisor layer, malware analysts can quickly and reliably reconstruct the big picture of the malware’s behavior regardless of the complexity of the threat or its behavior.
IOCs
Sample
4444458bf47925c82431843fd147aabbfbee71ca849fc711cb69b0cea01f4747
Appendix
Names compared against running processes
antidebug_antivm_index.yar
Acronis VSS Provider
.bak
