Ransomwarehigh
BlueSky Ransomware: Fast Encryption via Multithreading
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-0796 | Unauthenticated RCE in Microsoft SMBv3 (SMBGhost) | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2021-1732 | Out-of-Bounds Write Local Privilege Escalation in Microsoft Win32k (CVE-2021-1732) | 7.8 | 78% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | kmsauto.us | he PowerShell script start.ps1 , which is hosted at hxxps://kmsauto[.]us/someone/start.ps1 . The initial dropper is Base64-encoded |
| sha256 | 08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605 | 91dd325b0eddd2d0d9ddcee29de364f BlueSky Ransomware Payloads 08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605 Obfuscated PowerShell Downloader 969a4a55bb5cabc96ff003467b |
| sha256 | 0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b | 30bde51b6e3c960be0a3719b73d3875af8e1173bd94 MSIL Downloader 0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b 1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a64 |
| sha256 | 1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e | a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b 1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e 624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a23 |
| sha256 | 2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef | ssment . Indicators of Compromise SHA256 Hashes Description 2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96 |
| sha256 | 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb | 98cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb 840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d70 |
| sha256 | 4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab | a41a247de27d1d0b13ee0c2574c1e36ebc6d4 PowerShell Downloader 4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e117 |
| sha256 | 58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5 | f4fbdd48 CVE-2021-1732 Privilege Escalation Exploit RedLine 58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5 9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587 |
| sha256 | 624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b | 0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e 624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48 |
| sha256 | 6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48 | 88c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c JuicyPotato 6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48 CVE-2021-1732 Privilege Escalation Exploit RedLine 58db85f0 |
| sha256 | 840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d | f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb 840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64 |
| sha256 | 969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f | 13250d50ce5b7e8ba469680605 Obfuscated PowerShell Downloader 969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f PowerShell Downloader (decoded) c4e47cba1c5fedf9ba522bc2d2d |
| sha256 | 9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8 | 5f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5 9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8 aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a3732 |
| sha256 | aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94 | c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94 MSIL Downloader 0dfe7a93ff40834c072c7fdd9381771b1086b67f545 |
| sha256 | aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477 | 858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8 aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477 be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36e |
| sha256 | b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec | 927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d |
| sha256 | be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4 | 82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477 be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4 PowerShell Downloader 4d696c106f568b99308565172116933c0e26c |
| sha256 | c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce | 5c95c5823985416c019eb8abe2f PowerShell Downloader (decoded) c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce CVE-2020-0796 SMBGhost Privilege Escalation Exploit cf64c08 |
| sha256 | c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df | 5751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29d |
| sha256 | cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c | a7d65ce CVE-2020-0796 SMBGhost Privilege Escalation Exploit cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c JuicyPotato 6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc |
| sha256 | e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f | 8dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f BlueSky Ransomware Payloads 08f491d46a9d05f1aebc83d724ca32c |
| sha256 | fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189 | 29189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189 Payloads URLs hxxps://kmsauto[.]us/someone/l.exe hxxps://km |
| url | https://kmsauto.us/all.txt | //kmsauto[.]us/server.txt hxxps://kmsauto[.]us/encoding.txt hxxps://kmsauto[.]us/all.txt hxxps://kmsauto[.]us/someone/spooler.exe hxxps://kmsauto[ |
| url | https://kmsauto.us/app1.bin | 93a48be189 Payloads URLs hxxps://kmsauto[.]us/someone/l.exe hxxps://kmsauto[.]us/app1.bin hxxps://kmsauto[.]us/server.txt hxxps://kmsauto[.]us/enco |
| url | https://kmsauto.us/encoding.txt | xps://kmsauto[.]us/app1.bin hxxps://kmsauto[.]us/server.txt hxxps://kmsauto[.]us/encoding.txt hxxps://kmsauto[.]us/all.txt hxxps://kmsauto[.]us/someone |
| url | https://kmsauto.us/server.txt | ://kmsauto[.]us/someone/l.exe hxxps://kmsauto[.]us/app1.bin hxxps://kmsauto[.]us/server.txt hxxps://kmsauto[.]us/encoding.txt hxxps://kmsauto[.]us/al |
| url | https://kmsauto.us/someone/ | covered that start.ps1 downloaded a number of payloads from hxxps://kmsauto[.]us/someone/ based on the user’s privileges, as shown in Figure 2. Fig |
| url | https://kmsauto.us/someone/ghost.exe | to[.]us/sti/sti.bin hxxps://kmsauto[.]us/someone/potato.exe hxxps://kmsauto[.]us/someone/ghost.exe hxxps://kmsauto[.]us/someone/start.ps1 Ransom Note URLs h |
| url | https://kmsauto.us/someone/l.exe | age.ps1 downloads the final BlueSky ransomware payload from hxxps://kmsauto[.]us/someone/l.exe and saves it locally to the filesystem as javaw.exe , att |
| url | https://kmsauto.us/someone/potato.exe | o[.]us/someone/spooler.exe hxxps://kmsauto[.]us/sti/sti.bin hxxps://kmsauto[.]us/someone/potato.exe hxxps://kmsauto[.]us/someone/ghost.exe hxxps://kmsauto[.] |
| url | https://kmsauto.us/someone/spooler.exe | ps://kmsauto[.]us/encoding.txt hxxps://kmsauto[.]us/all.txt hxxps://kmsauto[.]us/someone/spooler.exe hxxps://kmsauto[.]us/sti/sti.bin hxxps://kmsauto[.]us/som |
| url | https://kmsauto.us/someone/start.ps1 | ped by the PowerShell script start.ps1 , which is hosted at hxxps://kmsauto[.]us/someone/start.ps1 . The initial dropper is Base64-encoded and then DEFLATE- |
| url | https://kmsauto.us/sti/sti.bin | sauto[.]us/all.txt hxxps://kmsauto[.]us/someone/spooler.exe hxxps://kmsauto[.]us/sti/sti.bin hxxps://kmsauto[.]us/someone/potato.exe hxxps://kmsauto[. |
From the original article
7 min read at unit42.paloaltonetworks.com
BlueSky ransomware is an emerging family that has adopted modern techniques to evade security defenses. Ransomware is a malicious program designed to encrypt a user’s data and demand a ransom for the decryption. BlueSky ransomware predominantly targets Windows hosts and utilizes multithreading to encrypt files on the host for faster encryption.
By Muhammad Umer Khan, Lee Wei, Yang Ji, Wenjun Hu · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.