ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Palo Alto Unit 42published ()ingested Brad Duncan

Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics

lowRansomware exploited in the wildimportance 27
AI summary · glm-5.3-flash

Unit 42 tracks the new Mole ransomware (CryptoMix family) spread via USPS-themed malspam, with tactics escalating to JavaScript downloaders dropping multiple malware families.

On April 11, 2017, a malspam campaign began distributing Mole ransomware, a CryptoMix-family strain, through USPS-themed emails linking to fake Microsoft Word Online sites offering a bogus Office plugin. By April 13 the campaign added Nemucod JavaScript downloaders installing Mole alongside Kovter and Miuref, and by April 18 it switched to the KINS banking Trojan before moving to speeding-ticket themes and a fake parking services website. Unit 42 notes the rapid tactic changes are likely intended to evade detection, and CryptoMix variants like Mole are typically repackaged within weeks.

  • Mole ransomware appends .MOLE extensions and belongs to the CryptoMix family
  • Campaign evolved in days: Google Docs links gave way to zip archives with Nemucod .js downloaders
  • Downloaders install three executables: Mole ransomware, Kovter, and Miuref
  • By April 18 the campaign switched to the KINS banking Trojan and later fake parking-ticket lures
Read the original
VendorsPalo Alto Networks
ProductsAutoFocusWireshark
MalwareMoleCryptoMixKovterMiurefNemucodKINS
OrganizationsUSPSPalo Alto Networks
CountriesUnited States
ATT&CK T1566.002 Spearphishing Link T1204.002 User Execution: Malicious File T1059.007 JavaScript/JScript T1105 Ingress Tool Transfer T1486 Data Encrypted for Impact
Tagsmole-ransomwarecryptomixmalspamnemucodkovtermiurefkinsusps

Indicators of compromiseAll →

TypeIndicatorContext
domainalita.kzugin.zip Examples for start of URLs generated by plugin.js: alita[.]kz/tmp/installation/language/cs-CZ/counter/ avtotur.com/libr
domainanilstone.ir/woorutu63408454 Links from the emails on Friday, April 14: anilstone[.]ir/libraries/joomla/string/wrapper/counter/1.htm Associated
domainbel.tramples of fake Microsoft Microsoft Word Online pages: posof.bel[.]tr/counter/1.htm tramplinonline[.]ru/counter/1.htm mattsfoto
domainboorsemsport.beom/libraries/fof/utils/ip/counter/ circus-stroy.ru/counter/ boorsemsport[.]be/templates/yoo_aurora/less/uikit/counter/ eurostandard[.]r
domaineurostandard.roboorsemsport[.]be/templates/yoo_aurora/less/uikit/counter/ eurostandard[.]ro/pics/size1/counter/ forum-turism.org[.]ro/images/layout/c
domainglochemindia.comsize1/counter/ forum-turism.org[.]ro/images/layout/counter/ glochemindia[.]com/modules/mod_roknavmenu/lib/librokmenu/counter/ sportbelij
domainideliverys.coms from the emails on Wednesday, April 12: uspsaeyyuia158140.ideliverys[.]com/ioxoory254772 uspsbhusisoz75.ideliverys[.]com/aagupto83 u
domainmaildeliverys.coms from the emails on Thursday, April 13: aexhnneq102342usps.maildeliverys[.]com/kovcemaw707572 bdguz0371usps.maildeliverys[.]com/usvyneye
domainmattsfotoalbum.de: 1,537 bytes File description: Contents of plugin.zip from mattsfotoalbum[.]de on April 13th SHA256 hash: 40e8dc147f189baf4660d5db8e0cd1
domainonline.ruytes File description: Contents of plugin.zip from tramplin.online[.]ru on April 13th SHA256 hash: a1670db6204f7666ad246cc11736b0
domainorg.rocounter/ eurostandard[.]ro/pics/size1/counter/ forum-turism.org[.]ro/images/layout/counter/ glochemindia[.]com/modules/mod_rok
domainsportbelijning.bemindia[.]com/modules/mod_roknavmenu/lib/librokmenu/counter/ sportbelijning[.]be/libraries/joomla/application/web/counter/
domaintramplinonline.rut Microsoft Word Online pages: posof.bel[.]tr/counter/1.htm tramplinonline[.]ru/counter/1.htm mattsfotoalbum[.]de/cache/counter/1.htm ani
sha2563b5b19ebe8d8b6c7e5b2ffd2cc194fad1ae6c9eade7646f48c595bd154f4b1e1f plugin.zip from anilstone[.]ir on April 14th SHA256 hash: 3b5b19ebe8d8b6c7e5b2ffd2cc194fad1ae6c9eade7646f48c595bd154f4b1e1 File name: exe1.exe File size: 85,504 bytes File descriptio
sha25640e8dc147f189baf4660d5db8e0cd1c647c7f167f7176c5d8ee03b6cac26fed2gin.zip from mattsfotoalbum[.]de on April 13th SHA256 hash: 40e8dc147f189baf4660d5db8e0cd1c647c7f167f7176c5d8ee03b6cac26fed2 File name: plugin.js File size: 1,382 bytes File descriptio
sha25641f171eb916d555dc7771ce71013572c498b8d620d2f72872c4b2f3b50c7ccb1malware retrieved by plugin.js on April 13th) SHA256 hash: 41f171eb916d555dc7771ce71013572c498b8d620d2f72872c4b2f3b50c7ccb1 File name: exe2.exe File size: 363,728 bytes File descripti
sha25650117ce3fe5dba572cf23584dc7541a7cfd4026d4316e69d29cdf536873fdf20malware retrieved by plugin.js on April 13th) SHA256 hash: 50117ce3fe5dba572cf23584dc7541a7cfd4026d4316e69d29cdf536873fdf20 File name: exe1.exe File size: 91,136 bytes File descriptio
sha2565459be968e2296a759dcafa7107ef06d02331b5291c9f3056077bcf38ce37d9emalware retrieved by plugin.js on April 13th) SHA256 hash: 5459be968e2296a759dcafa7107ef06d02331b5291c9f3056077bcf38ce37d9e File name: exe3.exe File size: 117,561 bytes File descripti
sha2568e210658f17a265f0c595b4f63ee7ba3db4c83f64c93f522e74e57e6fc547b11/wrapper/counter/1.htm Associated file hashes: SHA256 hash: 8e210658f17a265f0c595b4f63ee7ba3db4c83f64c93f522e74e57e6fc547b11 File name: plugin.exe File size: 149,346 bytes File descrip
sha256a1670db6204f7666ad246cc11736b052713a4413663f5cbe6aec90ab299431a7in.zip from tramplin.online[.]ru on April 13th SHA256 hash: a1670db6204f7666ad246cc11736b052713a4413663f5cbe6aec90ab299431a7 File name: plugin.js File size: 1,537 bytes File descriptio
sha256b2dfa063fa605d942822cc84ef90419e26cfa0030444751fc2b87f1456b72e30malware retrieved by plugin.js on April 13th) SHA256 hash: b2dfa063fa605d942822cc84ef90419e26cfa0030444751fc2b87f1456b72e30 File name: exe2.exe File size: 363,922 bytes File descripti
sha256b36a3a9e2b9129cbe7385c97fa24666d2d086f7bb8a3c9c4e019f14a41538be0omware from thru Google Docs URL on April 12th SHA256 hash: b36a3a9e2b9129cbe7385c97fa24666d2d086f7bb8a3c9c4e019f14a41538be0 File name: plugin.js File size: 1,369 bytes File descriptio
sha256ba1327106fa0bf82050cf1a1b9c0c119eb0ded63931af4127e5d541dfa2c6850malware retrieved by plugin.js on April 14th) SHA256 hash: ba1327106fa0bf82050cf1a1b9c0c119eb0ded63931af4127e5d541dfa2c6850 File name: exe3.exe File size: 221,974 bytes File descripti
sha256d9189f6df89acf8e2f0d689ab73429cde37f974ed423f91d1bcabfe5dda700famalware retrieved by plugin.js on April 14th) SHA256 hash: d9189f6df89acf8e2f0d689ab73429cde37f974ed423f91d1bcabfe5dda700fa File name: exe2.exe File size: 366,249 bytes File descripti
Full article1,849 words · extracted from unit42.paloaltonetworks.com · click to collapse

On April 11th 2017, we saw a new malicious spam campaign using United States Postal Service (USPS)-themed emails with links that redirected to fake Microsoft Word online sites. These fake Word sites asked victims to install malware disguised as a Microsoft Office plugin.

This campaign introduced a new ransomware called Mole, because names for any encrypted files by this ransomware end with .MOLE. Mole appears to be part of the CryptoMix family of ransomware since it shares many characteristics with the Revenge and CryptoShield variants of CryptoMix.

The campaign quickly changed tactics and increased complexity.

After two days on April 13, 2017, the attackers behind these fake office plugins changed the format and began including additional malware. Along with Mole ransomware, victims would be infected with both Kovter and Miuref. Then, on the following day, April 14, 2017, the attackers stopped using a redirect link in the malicious spam and instead linked directly to a fake Word online site. Figure 1 shows the attackers' changing tactics from Tuesday April 11, 2017 through Friday April 14, 2017.

Figure 1: Changing tactics April 11 - April 14, 2017

April 11th - Introducing Mole Ransomware

From Tuesday April 11th to the early hours of Wednesday April 12th, the fake Word Online used Google Docs links to provide Mole ransomware disguised as an Office plugin. Criminals behind this campaign abused Google Docs to provide a link for an executable file. File names were plug-in.exe or plugin.exe. Figure 2 shows how these fake Microsoft Word Online documents would attempt to lure users into downloading the Mole ransomware.

Figure 2: Fake Microsoft Word Online site with link to a Google Documents URL with the ransomware.

After downloading the executable, the infection chain is straight-forward. The victim executes the ransomware and infects his or her Windows computer. The mechanics behind a Mole ransomware infection have already been covered at the Internet Storm Center (ISC) and Bleeping Computer. Figure 3 shows the April 12 Mole ransomware in action.

Figure 3: Desktop of a Windows host infected with Mole ransomware on April 12th

April 13th - Introducing .js Files and Additional Malware

By Thursday April 13, 2017, this campaign changed tactics. The fake Microsoft Word Online sites no longer used a Google Docs URL to provide their malware. Instead, the malware was sent as a zip archive directly from the compromised site being used as a fake Microsoft Word Online page. The zip archives contained JavaScript (.js) files designed to infect Windows computers with Mole ransomware and additional malware.

The Figures 4 and 5 below illustrate the newer format used for malware infections by this campaign, where the new file is a zip archive named plugin.zip that contains a .js-based downloader named plugin.js.

Figure 4: Fake Microsoft Word Online site later on April 13th with link to a zip archive instead of an executable

Figure 5: The zip archive contains a .js file

The plugin.js is a type of file downloader commonly called a Nemucod. This .js file downloads and installs three Windows executable files named exe1.exe, exe2.exe, and exe3.exe as shown below in Figure 6.

Figure 6: Plugin.js installing 3 items of malware as shown in a reverse.it analysis

Network traffic generated by this infection is similar to Nemucod downloaders we have seen from other campaigns. In Figure 7 below, you can see URLs for exe1.exe, exe2.exe, and exe3.exe from forum-turism.org.ro.

Figure 7: Traffic from an infection filtered in Wireshark

The three items of follow-up malware are named exe1.exe, exe2.exe, and exe3.exe. In the early days of this campaign, they have been Mole ransomware, Kovter, and Miuref, respectively.

The Emails

Figure 8: An example of the malicious spam from Thursday April 13th

Emails from this campaign follow the same format as originally reported from Tuesday April 11, 2017. Figure 8 above shows an example email. They have a variety of subject lines, spoofed sending email addresses, and message text. Through Thursday April 13, 2017, the URLs were different for each message. By Friday April 14th, these emails were linking directly to the fake Microsoft Word Online pages, so the URLs for that day were the same.

Conclusion

Most large-scale malicious spam campaigns tend to stick with operating patterns that are much easier to identify and track. This particular campaign has evolved more quickly than we usually see. Such changing tactics are likely a way to avoid detection.

And this campaign continues to evolve. By Tuesday April 18, 2017, it stopped distributing Mole ransomware, and it began pushing the KINS banking Trojan with Kovter and Miuref. By Friday April 21, 2017, this campaign moved from USPS-themed emails to messages about speeding tickets, and it began utilizing a fake parking services website.

Why did we stop seeing Mole ransomware? Because families of ransomware are constantly changing. CryptoMix variants like Mole rarely stay around for more than a few weeks before being repackaged and distributed as a new variant. The samples of Mole ransomware we have identified so far are tagged in AutoFocus using the MoleRansomware tag.

We will continue to investigate this activity for applicable indicators to inform the community and further enhance our threat prevention platform.

Indicators from this campaign

Subject lines:

  • ATTENTION REQUIRED: INFO ON YOUR IMPENDING REFUND
  • ATTENTION REQUIRED: INFORMATION ON YOUR LATEST REFUND
  • ATTENTION REQUIRED: you are legally obliged to review the status of your shipment
  • AUTOMATED letter: refund information
  • AUTOMATED notice in regards to your item's status
  • AUTOMATED notification: refund information
  • AUTOMATED notification: refund information
  • AUTOMATED USPS notification: your shipment has been postponed
  • AUTOMATED USPS OFFICIAL LETTER CONCERNING YOUR SHIPMENT
  • AUTOMATED USPS statement: your package has been delayed
  • AUTOMATIC letter: moneyback information
  • AUTOMATIC notice concerning your package's location
  • AUTOMATIC notice: refund information
  • AUTOMATIC notification in regards to your package's status
  • AUTOMATIC notification regarding your order's location
  • IMMEDIATE ATTENTION NEEDED: your parcel's been delayed
  • IMMEDIATE ATTENTION REQUIRED: your parcel's been delayed
  • IMPORTANT USPS customer support letter
  • IMPORTANT USPS REFUND INFO
  • IMPORTANT USPS REFUND INFORMATION
  • IMPORTANT USPS system notice
  • Major problems reported to the USPS support team
  • Major trouble reported to the USPS customer support
  • Official letter from USPS support team
  • Official letter in regards to your parcel
  • Official notice from USPS support team
  • Official notification concerning your package
  • Official notification from USPS
  • Official notification from USPS customer support team
  • OFFICIAL USPS MONEYBACK INFO REGARDING YOUR ITEM
  • OFFICIAL USPS MONEYBACK INFORMATION
  • Official USPS notification concerning your package
  • PROMPT ACTION NEEDED: your order's been delayed
  • PROMPT ATTENTION NEEDED: your item's been delayed
  • There has been an issue with your package
  • There's been an issue with your package
  • URGENT USPS customer support letter
  • URGENT USPS customer support notification
  • URGENT USPS MONEYBACK INFORMATION REGARDING YOUR ITEM
  • URGENT: notice of postponement of your order
  • USPS CLIENT IMPORANT NEW DETAILS REGARDING YOUR PACKAGE
  • USPS CLIENT IMPORANT NEW INFORMATION REGARDING YOUR ITEM
  • USPS customer support notification: your order has been postponed
  • USPS OFFICIAL LETTER regarding your parcel
  • USPS official letter: big problems with your shipment
  • USPS official letter: serious issues with your order
  • USPS official letter: serious problems with your shipment
  • USPS official notice: serious trouble with your parcel
  • USPS official notification: serious issues with your package
  • USPS system notice: your package has been delayed
  • USPS system notification: your package has been delayed
  • USPS URGENT LETTER concerning your item
  • USPS USER URGENT NEW INFO IN REGARDS TO YOUR PARCEL
  • WARNING: DETAILS ON YOUR IMPENDING REFUND
  • WARNING: INFORMATION ON YOUR LATEST REFUND
  • WARNING: ISSUES WITH YOUR SHIPMENT
  • WARNING: PROBLEMS WITH YOUR PACKAGE
  • WARNING: TROUBLE WITH YOUR ITEM
  • WARNING: TROUBLE WITH YOUR SHIPMENT
  • WARNING: you are legally obliged to check the status of your order

Spoofed sending addresses (not from the actual domains listed):

Links from the emails on Wednesday, April 12:

  • uspsaeyyuia158140.ideliverys[.]com/ioxoory254772
  • uspsbhusisoz75.ideliverys[.]com/aagupto83
  • uspsboodud3731016.ideliverys[.]com/rzgyjotv3883685
  • uspsekakozq20701607.ideliverys[.]com/ciyjfm1453247
  • uspsfeu3245443.ideliverys[.]com/aivio24273
  • uspsgcoez80061682.ideliverys[.]com/ipeetol5862
  • uspsieibh26357.ideliverys[.]com/yey40177
  • uspsirokgouu81321536.ideliverys[.]com/wokivy5257
  • uspskposiuo204.ideliverys[.]com/ffauemyi1162
  • uspslycoddja50715724.ideliverys[.]com/mnqnoh53682573
  • uspsnarkk75185.ideliverys[.]com/syf11145060
  • uspsrekeky57218225.ideliverys[.]com/qi72870401
  • uspssenluefc87752667.ideliverys[.]com/pukooe40275334
  • uspstucaej4570.ideliverys[.]com/pbpylye22012283
  • uspsuhz63110412.ideliverys[.]com/t48844775
  • uspsuuesylmz2162311.ideliverys[.]com/yorixaig28
  • uspswmeeeny3538455.ideliverys[.]com/fgyzi77
  • uspsyhiwejug182483.ideliverys[.]com/gjesul74180
  • uspszovuoody3241005.ideliverys[.]com/deoa382
  • uspszujoea26262.ideliverys[.]com/vzy575324

Links from the emails on Thursday, April 13:

  • aexhnneq102342usps.maildeliverys[.]com/kovcemaw707572
  • bdguz0371usps.maildeliverys[.]com/usvyneye6
  • ebzizebk4124157usps.maildeliverys[.]com/uotajyax507
  • eccov13346821usps.maildeliverys[.]com/natyxr51034320
  • finupriw75037usps.maildeliverys[.]com/qaqabxei76122420
  • hoemurha6838215usps.maildeliverys[.]com/becevo581082
  • hwyrztkj8023435usps.maildeliverys[.]com/lyiaf13610344
  • ibaoe40687236usps.maildeliverys[.]com/vevroyo40678322
  • juo635usps.maildeliverys[.]com/hijxe7411
  • pehoaki1160481usps.maildeliverys[.]com/mvaklhma54511567
  • pfinyryf551041usps.maildeliverys[.]com/gsr58503
  • poyjsofq7716usps.maildeliverys[.]com/irirorcq3818
  • py18usps.maildeliverys[.]com/ou0453
  • rafoyky41usps.maildeliverys[.]com/ke244
  • roaaheis34435732usps.maildeliverys[.]com/iywyerk54374618
  • tenyti58325153usps.maildeliverys[.]com/mogfulep66534
  • ucasucu5264usps.maildeliverys[.]com/irwoqoqy563108
  • xicyw707845usps.maildeliverys[.]com/kyzupyi74721211
  • yfypus7588300usps.maildeliverys[.]com/n807837
  • zfsiqyjh4508687usps.maildeliverys[.]com/woorutu63408454

Links from the emails on Friday, April 14:

  • anilstone[.]ir/libraries/joomla/string/wrapper/counter/1.htm

Associated file hashes:

SHA256 hash: 8e210658f17a265f0c595b4f63ee7ba3db4c83f64c93f522e74e57e6fc547b11

  • File name: plugin.exe
  • File size: 149,346 bytes
  • File description: Mole ransomware from thru Google Docs URL on April 12th

SHA256 hash: b36a3a9e2b9129cbe7385c97fa24666d2d086f7bb8a3c9c4e019f14a41538be0

  • File name: plugin.js
  • File size: 1,369 bytes
  • File description: Contents of plugin.zip from tramplin.online[.]ru on April 13th

SHA256 hash: a1670db6204f7666ad246cc11736b052713a4413663f5cbe6aec90ab299431a7

  • File name: plugin.js
  • File size: 1,537 bytes
  • File description: Contents of plugin.zip from mattsfotoalbum[.]de on April 13th

SHA256 hash: 40e8dc147f189baf4660d5db8e0cd1c647c7f167f7176c5d8ee03b6cac26fed2

  • File name: plugin.js
  • File size: 1,382 bytes
  • File description: Contents of plugin.zip from anilstone[.]ir on April 14th

SHA256 hash: 3b5b19ebe8d8b6c7e5b2ffd2cc194fad1ae6c9eade7646f48c595bd154f4b1e1

  • File name: exe1.exe
  • File size: 85,504 bytes
  • File description: Mole ransomware (follow-up malware retrieved by plugin.js on April 13th)

SHA256 hash: 50117ce3fe5dba572cf23584dc7541a7cfd4026d4316e69d29cdf536873fdf20

  • File name: exe1.exe
  • File size: 91,136 bytes
  • File description: Mole ransomware (follow-up malware retrieved by plugin.js on April 14th)

SHA256 hash: d9189f6df89acf8e2f0d689ab73429cde37f974ed423f91d1bcabfe5dda700fa

  • File name: exe2.exe
  • File size: 366,249 bytes
  • File description: Kovter malware (follow-up malware retrieved by plugin.js on April 13th)

SHA256 hash: 41f171eb916d555dc7771ce71013572c498b8d620d2f72872c4b2f3b50c7ccb1

  • File name: exe2.exe
  • File size: 363,728 bytes
  • File description: Kovter malware (follow-up malware retrieved by plugin.js on April 13th)

SHA256 hash: b2dfa063fa605d942822cc84ef90419e26cfa0030444751fc2b87f1456b72e30

  • File name: exe2.exe
  • File size: 363,922 bytes
  • File description: Kovter malware (follow-up malware retrieved by plugin.js on April 14th)

SHA256 hash: ba1327106fa0bf82050cf1a1b9c0c119eb0ded63931af4127e5d541dfa2c6850

  • File name: exe3.exe
  • File size: 221,974 bytes
  • File description: Miuref malware (follow-up malware retrieved by plugin.js on April 13th)

SHA256 hash: 5459be968e2296a759dcafa7107ef06d02331b5291c9f3056077bcf38ce37d9e

  • File name: exe3.exe
  • File size: 117,561 bytes
  • File description: Miuref malware (follow-up malware retrieved by plugin.js on April 14th)

Other URLs associated with this activity:

Examples of fake Microsoft Microsoft Word Online pages:

  • posof.bel[.]tr/counter/1.htm
  • tramplinonline[.]ru/counter/1.htm
  • mattsfotoalbum[.]de/cache/counter/1.htm
  • anilstone[.]ir/libraries/joomla/string/wrapper/counter/1.htm

Examples of malware URLs disguised as Microsoft Office plugin:

  • posof.bel[.]tr/counter/plugin.exe
  • posof.bel[.]tr/counter/plugin.zip
  • mattsfotoalbum[.]de/cache/counter/plugin.zip
  • tramplinonline[.]ru/counter/plugin.zip

Examples for start of URLs generated by plugin.js:

  • alita[.]kz/tmp/installation/language/cs-CZ/counter/
  • avtotur.com/libraries/fof/utils/ip/counter/
  • circus-stroy.ru/counter/
  • boorsemsport[.]be/templates/yoo_aurora/less/uikit/counter/
  • eurostandard[.]ro/pics/size1/counter/
  • forum-turism.org[.]ro/images/layout/counter/
  • glochemindia[.]com/modules/mod_roknavmenu/lib/librokmenu/counter/
  • sportbelijning[.]be/libraries/joomla/application/web/counter/

Text extracted automatically; images, tables and formatting may be missing. Original: https://unit42.paloaltonetworks.com/unit42-mole-ransomware-one-malicious-spam-campaign-quickly-increased-complexity-changed-tactics/