FTCODE

Infection starts with spam emails containing malicious macro documents and, more recently, containing links to VBScripts that further download a PowerShell script known as FTCODE ransomware.

$task = ( schtasks . exe / create / TN "WindowsApplicationService" / sc DAILY / st 00 : 00 / f / RI 14 / du 23 : 59 / TR $ path_vbs )

It also creates a scheduled task named WindowsApplicationService for executing the WindowsIndexingService.vbs file.

CreateObject( "WScript.Shell" ).Run Data, Mod ... iex ( [ string ] [ System . Text . Encoding ] :: ASCII . GetString ( [ System . Convert ] :: FromBase64String ... ))

Recently, the Zscaler ThreatLabZ team came across PowerShell-based ransomware called “FTCODE,” which targets Italian-language users.

The downloaded script is saved in %Public%\Libraries\WindowsIndexingService.vbs . | In the recent campaign, the ransomware is being downloaded using VBScript. Once a user executes the VBScript, it executes the PowerShell script shown in the screenshot below.

Execution through API ... [ System . Security . Cryptography . ProtectedData ] : : Unprotect ... LoadLibrary ... GetProcAddress

Execution through Module Load ... [DllImport("nss3.dll" ...)] ... LoadLibrary

Once a user executes the VBScript, it executes the PowerShell script shown in the screenshot below.

$task = ( schtasks . exe / create / TN "WindowsApplicationService" / sc DAILY / st 00 : 00 / f / RI 14 / du 23 : 59 / TR $ path_vbs )

It also creates a scheduled task named WindowsApplicationService for executing the WindowsIndexingService.vbs file.

Further, the malware creates a shortcut file called windowsIndexingService.lnk in the victim’s startup folder, so it will execute at every reboot.

$task = ( schtasks . exe / create / TN "WindowsApplicationService" / sc DAILY / st 00 : 00 / f / RI 14 / du 23 : 59 / TR $ path_vbs )

It also creates a scheduled task named WindowsApplicationService for executing the WindowsIndexingService.vbs file.

Further, the malware creates a shortcut file called windowsIndexingService.lnk in the victim’s startup folder, so it will execute at every reboot.

With the obfuscated Javascript and VB Script samples... The JS Stage includes a few unused variables, entangled functions and scrambled strings.

The script first downloads a decoy image into the %temp% folder and opens it trying to trick users into believing that they simply received an image, but in the background, it downloads and runs the ransomware.

The first variant use regular expression (regex) for parse each lines, the result is merged for be the command to execute... The second VBS use too a regex for parse each line...

it writes GUID into the file w00log03.tmp and changes the file attribute to hidden.

...convert from the base 64 and execute it in memory.

The next functionalities are for dumping the credential from the differents versions of Outlook, this check for the IMAP, SMTP and POP3 credentials and configuration. | A second variant of the code use an additional class in .NET for stealing the credentials... The next section of code defines the function for decode the passwords from Chrome browser... dumping the credential from the differents versions of Outlook... IE use vault systems...

The script steals credentials from the Google Chrome browser from the file %UserProfile%\AppData\Local\Google\Chrome\User Data\*\Login Data.

It also checks to see if the operating system is above Windows 7, then it fetches credentials from the vault as shown in the code below.

The payload executes the functions and merges all the data... mergeInfo $olInfo $allInfo mergeInfo $chromeInfo $allInfo mergeInfo $ieInfo $allInfo mergeInfo $ffInfo $allInfo

The script checks the below paths and fetches the credentials from the Mozilla Firefox browser and the Mozilla Thunderbird email client... The script steals saved credentials by accessing the following registry key [for Outlook].

The malware sends information to its C&C as shown in the screenshot below.

...uses the downloadString method for getting the bytes, convert from the base 64 and execute it in memory.

The algorithm for generating the domains uses a list of string in base 64 and the date.

Further, it sends the stolen data to its C&C as shown in the below screenshot.

After that, it sends another post request to the C&C server with the &status=start parameter as shown below and starts the encryption process.

Another run-of-the-mill behaviour of ransomware these days is to disable the recovery mode, delete the system backups and shadow copies.