The Linux Variant of TargetCompany Ransomware targets ESXi Environments
The TargetCompany ransomware was discovered in June 2021. Trend Micro tracks it under the name “Water Gatpanapun,” and it has a leak site known as “Mallox.” According to the reports, this year’s group activity is greatest in Taiwan, India, Thailand, and South Korea.
TargetCompany has been developing methods to get beyond security defenses used by organizations since it was discovered. One such method includes abusing totally undetectable (FUD) obfuscator packers and using a PowerShell script to get around the Antimalware Scan Interface (AMSI).
TargetCompany has a new variation that was just found by Trend Micro that is specifically designed to target Linux environments.
Technical Analysis
Since June 2021, TargetCompany has been in operation. When a file is encrypted, the filename ends in, .mallox,.exploit,.architek, or .brg.
TargetCompany wipes shadow copies from every drive and stops some processes that might be keeping important files, such as databases, open, just like other ransomware.
Virtualization environments are not being targeted by the threat actors behind TargetCompany in an effort to broaden the scope of their attacks and increase the amount of disruption and damage. By using the “uname” command, the ransomware operators have extended their capacity to determine whether a system is operating in a VMware ESXi environment.
The system is running VMware’s ESXi hypervisor if the system name matches “vmkernel.” Next, in order to encrypt files with particular extensions, the malware switches to “VM mode.”
The ransomware drops a text file called TargetInfo.txt containing victim data after it has been run. The content of the file TargetInfo.txt is subsequently forwarded to a C2 server, just like in the case of the ransomware that targets Windows systems.
Following the encryption procedure, all folders holding encrypted files will contain a ransom note file with the name “HOW TO RECOVER!!.TXT.” The encrypted filenames are appended with the “.locked” extension by the malware.
Infection Chain
Data uploaded to Trend Micro’s C2 server allowed its researchers to associate the sample they examined with an affiliate known as “vampire.” Experts surmise that more comprehensive ransom demands and widespread targeting of IT systems are part of ongoing broader attacks. “Vampire” might have something to do with an affiliate that was mentioned in a Sekoia report.
Detection
rule win_targetcompany_ransomware {
    strings:
        $sequence_0 = { ff15???????? 85c0 7475 fe85a7fdffff 80bda7fdffff0c }
            // n = 5, score = 500
            //  ff15????????     |                    Â
            //  85c0         | test        eax, eax
            //  7475         | je         0x77
            //  fe85a7fdffff     | inc         byte ptr [ebp – 0x259]
            //  80bda7fdffff0c    | cmp         byte ptr [ebp – 0x259], 0xc
Â
        $sequence_1 = { 53 ff15???????? ff75e8 ff15???????? ff75e0 ff15???????? 3975f0 }
            // n = 7, score = 500
            //  53          | push        ebx
            //  ff15????????     |                    Â
            //  ff75e8        | push        dword ptr [ebp – 0x18]
            //  ff15????????     |                    Â
            //  ff75e0        | push        dword ptr [ebp – 0x20]
            //  ff15????????     |                    Â
            //  3975f0        | cmp         dword ptr [ebp – 0x10], esi
Â
        $sequence_2 = { eb43 b900100000 3bc1 733a 53 51 }
            // n = 6, score = 500
            //  eb43         | jmp         0x45
            //  b900100000      | mov         ecx, 0x1000
            //  3bc1         | cmp         eax, ecx
            //  733a         | jae         0x3c
            //  53          | push        ebx
            //  51          | push        ecx
Â
        $sequence_3 = { 83c424 33cd 33c0 5f e8???????? c9 c3 }
            // n = 7, score = 500
            //  83c424        | add         esp, 0x24
            //  33cd         | xor         ecx, ebp
            //  33c0         | xor         eax, eax
            //  5f          | pop         edi
            //  e8????????      |                    Â
            //  c9          | leave              Â
            //  c3          | ret                Â
Â
        $sequence_4 = { 813d????????a9aaaa0a 722b 68???????? 8d4dd4 }
            // n = 4, score = 500
            //  813d????????a9aaaa0a   |    Â
            //  722b         | jb         0x2d
            //  68????????      |                    Â
            //  8d4dd4        | lea         ecx, [ebp – 0x2c]
Â
        $sequence_5 = { e8???????? 57 6a0c 5a 8bce 8d45e0 e8???????? }
            // n = 7, score = 500
            //  e8????????      |                    Â
            //  57          | push        edi
            //  6a0c         | push        0xc
            //  5a          | pop         edx
            //  8bce         | mov         ecx, esi
            //  8d45e0        | lea         eax, [ebp – 0x20]
            //  e8????????      |                    Â
Â
        $sequence_6 = { 83ec40 53 56 33f6 57 8d5dc4 }
            // n = 6, score = 500
            //  83ec40        | sub         esp, 0x40
            //  53          | push        ebx
            //  56          | push        esi
            //  33f6         | xor         esi, esi
            //  57          | push        edi
            //  8d5dc4        | lea         ebx, [ebp – 0x3c]
Â
        $sequence_7 = { 50 8d45b0 50 e8???????? 8d45b0 50 8d85c0feffff }
            // n = 7, score = 500
            //  50          | push        eax
            //  8d45b0        | lea         eax, [ebp – 0x50]
            //  50          | push        eax
            //  e8????????      |                    Â
            //  8d45b0        | lea         eax, [ebp – 0x50]
            //  50          | push        eax
            //  8d85c0feffff     | lea         eax, [ebp – 0x140]
Â
        $sequence_8 = { bf???????? 8d75e8 e8???????? 8b1d???????? 8d75f0 }
            // n = 5, score = 500
            //  bf????????      |                    Â
            //  8d75e8        | lea         esi, [ebp – 0x18]
            //  e8????????      |                    Â
            //  8b1d????????     |                    Â
            //  8d75f0        | lea         esi, [ebp – 0x10]
Â
        $sequence_9 = { 8945ec e8???????? 53 6a01 8d758c e8???????? 53 }
            // n = 7, score = 500
            //  8945ec        | mov         dword ptr [ebp – 0x14], eax
            //  e8????????      |                    Â
            //  53          | push        ebx
            //  6a01         | push        1
            //  8d758c        | lea         esi, [ebp – 0x74]
            //  e8????????      |                    Â
            //  53          | push        ebx
Â
    condition:
        7 of them and filesize < 328704
}
Â
Recommendations
- Multifactor authentication (MFA) should be enabled to stop attackers from moving laterally within a network.
- When backing up essential files, follow the 3-2-1 rule: make three backup copies in two distinct file formats, and store one of the copies somewhere else.
- Patching and updating systems on a regular basis is crucial to maintaining patch management techniques that can prevent hostile actors from taking advantage of any software vulnerabilities. Operating systems and apps should also be kept up to date.
MITRE ATT&CK
| Tactic | Technique | ID |
| Defense Evasion | File Deletion | T1070.004 |
| Discovery | System Information Discovery | T1082 |
| Execution | Command and Scripting Interpreter: Unix Shell | T1059.004 |
| Command and Control | Ingress Tool Transfer | T1105 |
| Exfiltration | Exfiltration over Alternative Protocol | T1408 |
| Exfiltration over C2 Channel | T1041 | |
| Impact | Data Encrypted for Impact | T1486 |
IOCs
dffa99b9fe6e7d3e19afba38c9f7ec739581f656
2b82b463dab61cd3d7765492d7b4a529b4618e57
9779aa8eb4c6f9eb809ebf4646867b0ed38c97e1
3642996044cd85381b19f28a9ab6763e2bab653c Â
4cdee339e038f5fc32dde8432dc3630afd4df8a2Â Â
0f6bea3ff11bb56c2daf4c5f5c5b2f1afd3d5098
hxxp://111.10.231[.]151:8168/general/vmeet/upload/temp/x.sh
hxxp://111.10.231[.]151:8168/general/vmeet/upload/temp/x
hxxp://111.10.231[.]151:8168/general/vmeet/upload/temp/post.php