{"id":83919,"date":"2017-02-01T18:21:02","date_gmt":"2017-02-01T12:51:02","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=83919"},"modified":"2017-02-01T18:22:37","modified_gmt":"2017-02-01T12:52:37","slug":"beware-spora-professionally-designed-ransomware","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/beware-spora-professionally-designed-ransomware\/","title":{"rendered":"Beware of Spora &#8211; a professionally designed ransomware"},"content":{"rendered":"<p>Spora is a recent addition to the ransomware family that Quick Heal Lab has come across.\u00a0 It is a file encryptor ransomware that encrypts a user\u2019s files with strong encryption algorithm and demands a ransom. Spora is launched with a good infection routine, the capability to work offline, well-designed and managed payment portal dashboard, decryption key purchase options.<\/p>\n<p><strong>Infection Vector<br \/>\n<\/strong>Spora is delivered to the victim via spam emails containing a malicious .ZIP file as an attachment. This .ZIP file contains an HTML Application (\u2018.HTA\u2019) file that pretends to be an invoice in .PDF or .DOC format, wearing double extensions to those files (e.g. &lt;file_name&gt;.pdf.HTA). As \u2018Hide extensions for known file types\u2019 option is marked checked by default in many systems, it increases the chances of getting trapped in opening an .HTA file by mistaking it for harmless file types.<\/p>\n<p><strong>Infection Routine<br \/>\n<\/strong>Spora has a multistage infection behavior. When a malicious .HTA file is executed, it drops and executes the below files into the system using VBScript program:<\/p>\n<ul>\n<li><em>\u2018%Temp%\\close.js\u2019<\/em><\/li>\n<li><em>\u2018%Temp%\\doc_6d518e.docx\u2019<\/em><\/li>\n<\/ul>\n<p>close.js file further drops and runs this executable file &#8211; \u2018%Temp%\\&lt;Random_Alpha_Numeric_Characters&gt;.exe\u2019<br \/>\n\u2022 It is actually a file encryptor component that performs file encryption.<br \/>\n<em>\u2022 doc_6d518e.docx is a corrupt file that is intentionally dropped and opened to keep the victim busy in viewing it while files are getting encrypted in the background.<br \/>\n<\/em><\/p>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-83910\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2017\/02\/Spora1.jpg\" alt=\"spora1\" width=\"787\" height=\"332\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora1.jpg 1359w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora1-300x126.jpg 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora1-768x324.jpg 768w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora1-1024x432.jpg 1024w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora1-789x333.jpg 789w\" sizes=\"(max-width: 787px) 100vw, 787px\" \/>Figure 1. Corrupt document to fool a victim<\/p>\n<p>Spora was not found appending any extension to the encrypted files. When encryption is over, a ransom note is displayed (shown below), highlighting the uniquely generated \u2018Infection ID\u2019 and basic instructions.<\/p>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-83911\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2017\/02\/Spora2.jpg\" alt=\"spora2\" width=\"808\" height=\"341\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora2.jpg 1090w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora2-300x127.jpg 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora2-768x324.jpg 768w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora2-1024x432.jpg 1024w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora2-789x333.jpg 789w\" sizes=\"(max-width: 808px) 100vw, 808px\" \/>Figure 2. Spora ransom note with an infection ID<\/p>\n<p>A .KEY file is dropped on the desktop, containing information about \u2018encrypted-encryption keys\u2019 used to encrypt files. In order for the victim to get complete access to the payment portal, they need to upload .KEY file to the portal to synchronize the infected computer with the payment portal. To do so, the below panel is provided.<\/p>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-83912\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2017\/02\/Spora3.jpg\" alt=\"spora3\" width=\"349\" height=\"119\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora3.jpg 314w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora3-300x102.jpg 300w\" sizes=\"(max-width: 349px) 100vw, 349px\" \/>Figure 3. Key upload panel on Spora payment portal<\/p>\n<p>Once synchronized, the victim can choose from a number of purchase options available on a \u2018My Purchase\u2019 section of the portal.<\/p>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-83913\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2017\/02\/Spora4.jpg\" alt=\"spora4\" width=\"571\" height=\"229\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora4.jpg 571w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora4-300x120.jpg 300w\" sizes=\"(max-width: 571px) 100vw, 571px\" \/>Figure 4. Decryptor purchase options<\/p>\n<p><strong>FULL RESTORE<\/strong> &#8211; With this, the user can have all their encrypted data restored.<\/p>\n<p><strong>IMMUNITY<\/strong> &#8211; With this, the user can buy immunity against future Spora attacks.<\/p>\n<p><strong>REMOVAL &#8211;<\/strong> With this, the user can have the Spora malware completely removed from their computer.<\/p>\n<p><strong>FILE RESTORE &#8211;<\/strong> Offers two options; decrypt two files for free or decrypt a selection of files for $30.<\/p>\n<p>As you can see, Spora offers the victim with a variety of options to take care of the situation. For instance, a victim might be less likely to pay the ransom because they know they have safely backed up their data. However, they would still want to have the malware removed from the system &#8211; which gives the \u2018Removal\u2019 option.<\/p>\n<p><strong>Quick Heal Detection<br \/>\n<\/strong>Quick Heal antivirus successfully prevents Spora infections at multiple stages.<\/p>\n<p>\u2022 <strong>Quick Heal Email Protection<\/strong> successfully prevents download of the malicious .ZIP attachment which is the first stage of the infection.<\/p>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-83914\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2017\/02\/Spora5.jpg\" alt=\"spora5\" width=\"296\" height=\"182\" \/>Figure 5. Quick Heal Email Protection<\/p>\n<p>As shown in the image above, the malicious .HTA file has been successfully detected as \u2018JS.Nemucod.BJF\u2019 and deleted thereafter.<\/p>\n<p>\u2022 <strong>Quick Heal Anti-ransomware<\/strong> protection successfully detects potential file encryption activities and alerts the user<\/p>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-83915\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2017\/02\/Spora6.jpg\" alt=\"spora6\" width=\"462\" height=\"266\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora6.jpg 462w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora6-300x173.jpg 300w\" sizes=\"(max-width: 462px) 100vw, 462px\" \/>Figure 6. Quick Heal Anti-Ransomware alert<\/p>\n<p style=\"text-align: left\">\u2022 <strong>Quick Heal Behavior Detection System<\/strong> successfully detects malicious activities and alerts the user<\/p>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-83916\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2017\/02\/Spora7.jpg\" alt=\"spora7\" width=\"458\" height=\"263\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora7.jpg 458w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/02\/Spora7-300x172.jpg 300w\" sizes=\"(max-width: 458px) 100vw, 458px\" \/>Figure 7. Quick Heal Behavior Detection System alert<\/p>\n<p><strong>Conclusion<br \/>\n<\/strong>It is not hard to guess that the creators of Spora have taken their time in developing this ransomware to make it effective, and professional at the same time.<\/p>\n<p>A nicely designed decryptor portal dashboard, synchronization between the portal and infected system using a .KEY file, and multiple purchase option for decryption signify how attackers are using complex tactics in creating ransomware.<\/p>\n<p><strong>How to stay safe against such ransomware attacks<\/strong><\/p>\n<ul>\n<li>Never download attachments that arrive in emails from unknown or unexpected sources.<\/li>\n<\/ul>\n<ul>\n<li>Take regular backups of your files. Remember to disconnect the Internet when you are backing up on a hard drive. Unplug the drive before you go online again.<\/li>\n<\/ul>\n<ul>\n<li>Apply all recommended security updates (patches) to your Operating System, and programs like Adobe, Java, web browsers, etc.<\/li>\n<\/ul>\n<ul>\n<li>Install an <a href=\"https:\/\/www.quickheal.co.in\/home-users\/quick-heal-total-security\">antivirus software<\/a> that offers several layers of security. More importantly, keep the software up-to-date.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><strong>Acknowledgment<\/strong><\/p>\n<p>Subject Matter Expert &#8211;<\/p>\n<p>Prashil Moon (Threat Research and Response Team)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Spora is a recent addition to the ransomware family that Quick Heal Lab has come across.\u00a0 It is a file encryptor ransomware that encrypts a user\u2019s files with strong encryption algorithm and demands a ransom. Spora is launched with a good infection routine, the capability to work offline, well-designed and managed payment portal dashboard, decryption [&hellip;]<\/p>\n","protected":false},"author":29,"featured_media":83917,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[303,910,5],"tags":[50,1400],"class_list":["post-83919","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing","category-ransomware","category-security","tag-ransomware","tag-spora"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/83919"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=83919"}],"version-history":[{"count":3,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/83919\/revisions"}],"predecessor-version":[{"id":83922,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/83919\/revisions\/83922"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/83917"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=83919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=83919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=83919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}