RedEnergy Stealer Mixes Ransomware and Infostealer in One

Zscaler ThreatLabz recently made an intriguing discovery, uncovering a new variation of malware called RedEnergy stealer. This particular malware falls under the category of Stealer-as-a-Ransomware, although it should not be mistaken for the Australian company Red Energy.

RedEnergy stealer adopts a clever approach by utilizing a fake update campaign, targeting various industries. It possesses the ability to pilfer sensitive data from different web browsers, enabling the extraction of valuable information. Additionally, it incorporates various modules to carry out ransomware activities. Despite the common method names observed during analysis, the malware retained its name.

Earlier this year, ThreatLabz introduced a novel threat category called RAT-as-a-Ransomware. However, researchers have now identified another hybrid category called Stealer-as-a-Ransomware, which follows a similar approach. RedEnergy stealer, the latest discovery, combines stealthy data theft with encryption to inflict maximum damage and gain control over victims. It targets several industries, including energy utilities, oil and gas, telecommunications, and machinery. These advancements in malware signify a noteworthy shift and significant progress beyond traditional ransomware attacks.

The sample variant of Stealer-as-a-Ransomware analyzed in this case study employs a deceptive campaign known as FAKEUPDATES to lure its targets. It tricks them into promptly updating their web browsers. Once inside the system, this malicious variant secretly extracts sensitive information and proceeds to encrypt compromised files. This leaves victims vulnerable to potential data loss, exposure, or even the illicit sale of their valuable data.

RedEnergy in Brief

ThreatLabz' latest research uncovers a highly sophisticated malware campaign that exploits reputable LinkedIn pages of industries to target victims. Examples include the Philippines Industrial Machinery Manufacturing Company and various organizations in Brazil. The attackers initiate the attack when users click on a link to visit a compromised company's website from LinkedIn. They employ multi-stage techniques and disguise the malware as browser updates to deceive users.

Stealer-as-a-Ransomware: The analyzed malware possesses dual capabilities as both a stealer and ransomware, representing a concerning evolution in ransomware attacks. It utilizes obfuscation techniques and employs HTTPS for command and control communication, making detection and analysis challenging.

Multi-Stage Execution: The malware operates through multiple stages, starting with the execution of disguised malicious executables. It establishes persistence, communicates with DNS servers, and downloads additional payloads from remote locations. Suspicious FTP interactions suggest potential data exfiltration and unauthorized file uploads.

Ransomware Functionality: The malware incorporates ransomware modules that encrypt user data with the ".FACKOFF!" extension, rendering it inaccessible until a ransom is paid. It also modifies the desktop.ini file to evade detection and alter file system folder display settings.

Deletion of Shadow Drive Data: In its final stage, the malware erases shadow drive data and Windows backup plans, reinforcing its ransomware characteristics. It drops a batch file and a ransom note, demanding payment in exchange for file decryption.

Mode of Operation of the RedEnergy Malware

The operating method for this threat campaign involves a deceitful redirection technique. When users attempt to visit the targeted company's website through their LinkedIn profile, they unknowingly get redirected to a malicious website. There, they are prompted to install what appears to be a legitimate browser update, presented as a set of four different browser icons. However, instead of a genuine update, the unsuspecting user inadvertently downloads an executable file known as RedStealer.

Interestingly, regardless of which browser icon the user selects, they are redirected to the same URL: www[.]igrejaatos2[.]org/assets/programs/setupbrowser.exe. This URL initiates the download of a file named setupbrowser.exe, which is part of the malicious payload.

What makes this threat campaign even more deceptive is the use of a misleading download domain called www[.]igrejaatos2[.]org. This domain masquerades as a ChatGpt site, enticing victims to download a counterfeit offline version of ChatGpt. However, upon downloading the purported ChatGpt zip file, the victim unknowingly acquires the same malicious executable mentioned earlier.

It is crucial for individuals and organizations to exercise extreme caution when accessing websites, particularly those linked from LinkedIn profiles. Diligence in verifying the authenticity of browser updates and being wary of unexpected file downloads is paramount to protect against such malicious campaigns.