Once executed on the infected computer, Armage ransomware opens the command line message narrating the encryption algorithm it has used. See fig 1.<\/p>\n
![\"\"](\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/08\/1-1.jpg\")
<\/p>\n
Fig 1. Command line prompt<\/p>\n
The ransomware does not drop any artifact to perform the malicious activity or to encrypt data. The entire malicious activity (encryption) is carried out by the mother file itself.<\/p>\n
After invading, the ransomware searches for the first file alphabetically to encrypt the data using Windows API FindFirstFileA as shown in fig 2 and to find the next file it has used FindNextFileA API as shown in fig 3.<\/p>\n
![\"\"](\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/08\/2-2.png\")
<\/p>\n
Fig.2 FindFirstfileA API is used.<\/p>\n
![\"\"](\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/08\/3-2.png\")
<\/p>\n
Fig 3. FindNextFileA API is used to find the files recursively<\/p>\n
After encrypting the data from the folder, Armage drops \u2018Notice.txt\u2019 – a ransom note mentioning the ransom to be paid with other details. Further, the ransomware drops \u2018Notice.txt\u2019 in all the folders wherever data is encrypted.<\/p>\n
![\"\"](\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/08\/4-1.png\")
<\/p>\n
Fig.4 Code used to create a new file \u2018Notice.txt\u2019<\/p>\n
![\"\"](\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/08\/5-2.png\")
<\/p>\n
Fig 5. Code used to show details to the victim<\/p>\n
The ransom note also mentions the below.<\/p>\n
\u2018Your files was encrypted using AES-256 algorithm. Write me to e-mail: armagedosevin@aol.com to get your decryption key.\u2019<\/em><\/p>\n As per the PE file analysis, we have found that ransomware injects itself into the processes that run with the administrative privileges so that it can delete shadow copies using command \u2018vssadmin delete shadows \/all.<\/p>\n This command executes the vssadmin.exe utility and deletes all copies quietly. Fig 5 below shows the code used to delete the shadow copies.<\/p>\n Fig 6. Code used to delete the shadow copies<\/p>\n Below are the API\u2019s used by ransomware to encrypt the data.<\/p>\n Fig 7. API\u2019s used to encrypt the files<\/p>\n The ransomware encrypts all PE and Non-PE files with \u2018.armage\u2019 extension as shown below.<\/p>\n Fig 8. Encrypted files with \u2018.armage\u2019 extension<\/p>\n How Quick Heal protects its users from the Armage ransomware<\/strong><\/p>\n Quick Heal successfully blocks Armage with the following multilayered protection layers:<\/p>\n Fig 9. Behavior detection system blocks the malware.<\/p>\n Fig 10. Anti-Ransomware tool also blocks the malware<\/p>\n How to stay safe from ransomware attacks<\/strong><\/p>\n Indicators of compromise<\/strong><\/p>\n <\/p>\n Subject Matter Experts<\/strong><\/p>\n Poonam Dongare, Priyanka Dhasade, Shashikala Halagond, Manish Patil, Shivani Mule | Quick Heal Security Labs<\/p>\n","protected":false},"excerpt":{"rendered":" In July last week, Quick Heal Security Labs detected a new ransomware called Armage. It appends \u2018.Armage\u2019 extension to files it encrypts. Armage ransomware uses the AES-256 encryption algorithm to encode files making them inoperable. It spreads via spam emails and corrupted text files. Technical analysis Once executed on the infected computer, Armage ransomware opens […]<\/p>\n","protected":false},"author":39,"featured_media":86602,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55,21,41,133,24,4,303,5,6,1],"tags":[56,163,152,22,23,43,50],"class_list":["post-86587","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android","category-email","category-facebook","category-hacker","category-malware","category-news","category-phishing","category-security","category-tips","category-uncategorized","tag-android-security","tag-cyber-crime","tag-cyberespionage","tag-email-malware","tag-fraudulent-email","tag-facebook-malware","tag-ransomware"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86587"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/39"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=86587"}],"version-history":[{"count":10,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86587\/revisions"}],"predecessor-version":[{"id":86632,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86587\/revisions\/86632"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/86602"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=86587"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=86587"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=86587"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"\"](\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/08\/6-5.png\")
<\/p>\n![\"\"](\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/08\/Api-New.jpg\")
<\/p>\n![\"\"](\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/08\/7-1.jpg\")
<\/p>\n\n
![\"\"](\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/08\/BDS-1.jpg\")
<\/p>\n![\"\"](\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/08\/9-1.jpg\")
<\/p>\n\n
\n