A look at recent Stampado ransomware variant

Introduction

Stampado is one of the many new ransomware strains we have seen in 2016. Stampado was first seen in the wild in July 2016, as one of the cheapest pieces of ransomware available on the underground forums.  

Figure 1: Stampado sales ad on dark web

In this report, we will provide an analysis of Stampado ransomware, shown to be capable of encrypting files with more than 1,200 file extensions and containing self-propagating features. In addition to the typical ransom demand, this variant threatens to delete a randomly selected file every six hours until payment and, if no payment is received within 96 hours, all files will be permanently deleted.

Infection Cycle

Stampado typically arrives via spam e-mail or drive-by downloads. The file we examined was packed using UPX packer and written in AutoIt. Upon unpacking and decompilation, the AutoIt code appears to be obfuscated.

Figure 2: Obfuscated Code

Upon deobfuscation, the code appears as shown below:

Figure 3: Deobfuscated code

Installation and persistence

The malware installs itself in the %AppData% folder with the name scvhost.exe in an attempt to look like a genuine Windows process (svchost.exe) and also creates the following autostart registry entry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Windows Update" %AppData%\scvhost.exe

Stampado runs itself from the new location as scvhost.exe and terminates the current process.

Figure 4: Installation and persistence code

The main functionality of the Stampado variant is illustrated in the infographic below:

Figure 5: Stampado overall activity diagram

Self-replication

This ransomware also has a worm-like spreading functionality. It attempts to make a copy of itself on the removable drives and network drives reachable from the infected system. The malware also registers a callback function to monitor the removable drives; this way, it can infect the removable drive as soon as it connects to the compromised system.

It drops a copy of itself at [DrivePath]\myDisk\drivers.exe with file attributes set to +SHR to hide itself, creates file [DrivePath]\autorun.inf and creates shortcut files with the names of existing files pointing to malware executable, after hiding the original files. This will cause the malware executable to run when the user clicks on any shortcut file.

Figure 6: Self-replication code

Process Protection

Before starting file encryption, the malware protects its process from being terminated by exploiting an old kernel bug (setting the "ProcessSelfDelete" flag). This trick was verified to be working on Windows 7 64-bit.

Figure 7: Process Protection Code

Encryption over encryption

Stampado will not spare you even if you have already been infected with other ransomware strains and will re-encrypt already encrypted files. The victim has to pay ransom twice to get the original files back. This ransomware is targeting files already encrypted by multiple ransomware families along with a long list of important filetypes. Some of the targeted files encrypted by other ransomware strains are:

"*.locky;*.zepto;*.cerber;*.crypt;*.crypz;*.cryptowall;
*.enciphered;*.cryptolocker;*.cryp1; *.lol!;*.breaking_bad;
*.crypted;*.encrypted;*.xxx;*.crjoker;*.encrypt;*.zcrypt;*.EnCiPhErEd;"

Stampado encrypts files using AES (Advanced Encryption Standard) and a Symmetric key encryption algorithm (which uses same key for encryption and decryption) with key length of 256. It generates encryption key based on following data:

salt string + embedded e-mail + “stamp” + ComputerName + CPUArch + OSArch + “pado”

Figure 8: Part of the Stampado encryption key generation code

Note: salt string is not present in all samples(not present in sample analyzed)

It searches following folders for files to encrypt from home drive:

Figure 9: Building list of folders for file encryption

The malware excludes the following folders from the home drive: Windows, Program Files, User Profiles.

After building a list of folders to encrypt, Stampado will start encrypting files one by one. It will create a temporary file with random name including ~(7 random characters).tmp, for example, ~afzyatd.tmp, ~irusgld.tmp, or ~ifecffl.tmp, to save the intermediate encrypted file. Once fully encrypted, the original file gets deleted and the temporary file gets renamed to a hexadecimal string with a ".locked" extension.

While encrypting files, Stampado avoids wasting its time on unimportant files by excluding files if their path or name contains the following strings:

• "Temporary Internet Files"
• "INetCache"
• "desktop.ini"
• "stampado_debug.txt"

The file stampado_debug.txt is possibly what was used by the author during development of the malware.

Stampado will also maintain two files in the %AppData% folder with hexadecimal names; one file is for the list of encrypted files and the other is for the status of malware activities.

Figure 10: List of encrypted files maintained by Stampado

Figure 11: Maintained status of activity during different stages

When the encryption of all the target file types is complete, Stampado will display a ransom note as shown below:

Figure 12: Stampado ransom note

The victim is instructed to contact the attacker over the displayed email address for further information on the ransom required and method of payment. The malware says it will delete the key from the command and control (C&C) server after 96 hours, but this is not true, as there is no private key involved. But it does attempt to delete all encrypted files from the system if no ransom is paid within 96 hours.

Cleanup and remediation

The ransom note shows the unique ID of the victim and includes a text box to accept the decryption key. If accepted and submitted, the key will decrypt the files and delete itself from system. The variants of Stampado we have seen use symmetric encryption, and the encryption key is generated locally based on the victim’s system details along with other constant values — without any communication to the C&C server.

Figure 13: Decryption and cleanup window

To clean a system after a Stampado infection, you will either need to enter the decryption code or kill the process and remove the autostart entries, which would save your files from being deleted. If you are unable to kill the process, you can run the following command in order to remove the autostart registry entry, which prevents the malware from running after system restart:

REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Windows Update"

Restart the system, run folowing command on command prompt to delete scvhost.exe from %AppData% folder and use the freely available decrypter by Fabian Wosar to decrypt your files.

CD %APPDATA%

DEL scvhost.exe

Conclusion

Ransomware remains one of the most prevalent threats in 2016. We have seen over a dozen new ransomware families in the wild actively targeting users. Fortunately, in the case of Stampado, it is relatively easy to recover your files. We advise you not to pay the ransom, as it is possible to decrypt your files without doing so. To protect your data against ransomware, always keep your software updated and conduct regular backups.

Indicators of Compromise:

MD5: 5a40644131c9c7e5dc0603d774a36e6c

URL serving sample: grmpixelmon[.]co/stampado.exe

Files dropped:

%AppData%\scvhost.exe

%AppData%\<Hexdecimalname>

%AppData%\<Hexdecimalname>

[DrivePath]\myDisk\drivers.exe

<filepath>/<encryptedname>.locked

Registry Entries Created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Windows Update"

Extensions targeted

Stampado encrypts a total of 1,240 file type extensions. Its list includes extensions used by other ransomware families, including Locky, Crypted, Encrypted, zCrypt, CryptoWall, Cryptz, CryptoLocker, and others.

Below is the list of all extensions:

"*.jpg;*.jpeg;*.gif;*.bmp;*.tiff;*.c;*.doc;*.docx;*.ppt;*.pptx;*.xls;*.xlsx;*.mov;*.mp3;*.cpp;*.au3;*.pas;*.php;*.wav;*.wma;*.wmv;*.mp4;*.rar;*.zip;*.7z;*.001;*.html;*.pdf;*.txt;*.ai;*.dmg;*.dwg;*.ps;
*.flv;*.xml;*.skp;*.aiml;*.sql;*.cdr;*.svg;*.png;*.ico;*.ani;*.m4a;*.avi;*.csv;*.d3dbsp;*.sc2save;*.sie;*.sum;*.ibank;*.t13;*.t12;*.qdf;*.gdb;*.tax;*.pkpass;*.bc6;*.bc7;*.bkp;*.bak;*.qic;*.bkf;*.sidn;
*.sidd;*.mddata;*.itl;*.itdb;*.icxs;*.hvpl;*.hplg;*.hkdb;*.mdbackup;*.syncdb;*.gho;*.cas;*.map;*.wmo;*.itm;*.sb;*.fos;*.mcgame;*.vdf;*.ztmp;*.sis;*.sid;*.ncf;*.menu;*.layout;*.dmp;*.blob;*.esm;*.vtf;
*.dazip;*.fpk;*.mlx;*.kf;*.iwd;*.vpk;*.tor;*.psk;*.rim;*.w3x;*.fsh;*.ntl;*.arch00;*.lvl;*.snx;*.cfr;*.ff;*.vpp_pc;*.lrf;*.m2;*.mcmeta;*.vfs0;*.mpqge;*.kdb;*.db0;*.DayZProfile;*.rofl;*.hkx;*.bar;*.upk;
*.das;*.iwi;*.litemod;*.asset;*.forge;*.ltx;*.bsa;*.apk;*.re4;*.sav;*.lbf;*.slm;*.bik;*.epk;*.rgss3a;*.pak;*.big;*.unity3d;*.wotreplay;*.xxx;*.desc;*.py;*.m3u;*.js;*.css;*.rb;*.p7c;*.p7b;*.p12;*.pfx;
*.pem;*.crt;*.cer;*.der;*.x3f;*.srw;*.pef;*.ptx;*.r3d;*.rw2;*.rwl;*.raw;*.raf;*.orf;*.nrw;*.mrwref;*.mef;*.erf;*.kdc;*.dcr;*.cr2;*.crw;*.bay;*.sr2;*.srf;*.arw;*.3fr;*.dng;*.indd;*.eps;*.pdd;*.psd;*.dbfv;
*.mdf;*.wb2;*.rtf;*.wpd;*.dxg;*.xf;*.pst;*.accdb;*.mdb;*.pptm;*.ppsx;*.pps;*.xlk;*.xlsb;*.xlsm;*.wps;*.docm;*.odb;*.odc;*.odm;*.odp;*.ods;*.odt;*.json;*.dat;*.efx;*.sdf;*.vcf;*.ses;*.wallet;*.1password;
*.write;*.ini;*.axx;*.md;*.manifest;*.aes;*.fdb;*.fdk;*.gdk;*.db;*.veg;*.3ds;*.anim;*.bvh;*.fxa;*.ge2;*.iff;*.ma;*.mb;*.mcfi;*.mcfp;*.mel;*.mll;*.mp;*.mtl;*.obj;*.ogex;*.raa;*.rtg;*.skl;*.soft;*.spt;
*.swatch;*.vrimg;*.2015;*.qif;*.t14;*.ofx;*.qfx;*.ebc;*.ebq;*.iif;*.ptb;*.tax2014;*.qbw;*.mye;*.qbm;*.myox;*.ets;*.tax2012;*.tax2013;*.tt14;*.lgb;*.epb;*.500;*.txf;*.tax2011;*.qbo;*.t11;*.t15;*.gpc;
*.tax2015;*.tlg;*.qtx;*.itf;*.tt13;*.t10;*.qsd;*.ofc;*.bc9;*.tax2010;*.13t;*.mny;*.qxf;*.amj;*.m14;*._vc;*.tbp;*.qbk;*.aci;*.npc;*.sba;*.qbmb;*.cfp;*.nv2;*.tt12;*.n43;*.tfx;*.let;*.des;*.210;*.dac;
*.slp;*.tax2009;*.qb2013;*.qbx;*.saj;*.ssg;*.zdb;*.t09;*.tt15;*.epa;*.qch;*.qby;*.tax2008;*.pd6;*.qbr;*.ta1;*.rdy;*.sic;*.lmr;*.pr5;*.op;*.brw;*.asec;*.crypt8;*.crypt;*.obb;*.crypt12;*.crypt7;*.rem;
*.ksd;*.db.crypt8;*.sdtid;*.iwa;*.sme;*.crypt10;*.vdata;*.key;*.menc;*.acsm;*.crypt5;*.p7s;*.aee;*.crypt9;*.jpgenx;*.db.crypt7;*.awsec;*.adoc;*.eslock;*.emc;*.pp7m;*.p7e;*.signed;*.ftil;*.sec;*.jse;
*.gpg;*.p7m;*.ize;*.ple;*.tc;*.crypted;*.vsf;*.enc;*.ifs;*.jpgx;*.p7z;*.uhh;*.cxt;*.bioexcess;*.pgp;*.cip;*.mse;*.aes256;*.c2v;*.hds;*.muk;*.dcv;*.pi2;*.eoc;*.pdc;*.mpqe;*.ee;*.kdbx;*.egisenc;*.dc4;
*.hde;*.hid2;*.spk;*.rgss2a;*.cng;*.flka;*.sth;*.afp;*.rfp;*.rsa;*.wbp;*.hsh;*.ekb;*.lf;*.v2c;*.flk;*.lock3;*.uea;*.aex;*.wbc;*.cfd;*.sef;*.clk;*.leotmi;*.hid;*.crypt6;*.base64;*.safe;*.asc;*.pde;
*.lxv;*.skr;*.jsn;*.kwm;*.apw;*.hc;*.vmdf;*.k2p;*.db.crypt5;*.cfe;*.daf;*.pkk;*.dim;*.img3;*.pkr;*.secure;*.rxf;*.cgp;*.dsc;*.xdb;*.epf;*.keychain;*.p7x;*.puf;*.enk;*.switch;*.mck;*.edc;*.auth;*.docenx;
*.uue;*.prv;*.stxt;*.zbb;*.eff;*.dwk;*.fpa;*.sign;*.mfs;*.sdsk;*.pdfenx;*.pwl;*.embp;*.ecr;*.mnc;*.czip;*.mim;*.ppenc;*.csj;*.edat;*.ueaf;*.jpegenx;*.eea;*.devicesalt;*.pae;*.mcrp;*.zix;*.jbc;*.daz;
*.nip;*.dsa;*.lma;*.hdt;*.bfa;*.migitallock;*.flkb;*.xia;*.1pif;*.kgb;*.kde;*.cpt;*.hop;*.kge;*.bfe;*.svz;*.ibe;*.bpk;*.tzp;*.bnc;*.ptxt;*.sgz;*.xef;*.flkw;*.crl;*.wmt;*.poo;*.cyp;*.uu;*.vf3;*.pkcs12;
*.rsdf;*.xcon;*.ad;*.vp;*.meo;*.docxenx;*.sdc;*.pf;*.efa;*.mbz5;*.rpz;*.cry;*.qze;*.saa;*.wmg;*.sjpg;*.pvk;*.alk;*.afs3;*.lp7;*.txtenx;*.abc;*.opef;*.eee;*.agilekeychain;*.vme;*.$48E2C16BE0736950;
*.gte;*.egs;*.mkeyb;*.fve;*.pandora;*.rdz;*.wza;*.jpi;*.smbp;*.pjpg;*.efu;*.xmm;*.paw;*.rte;*.rbb;*.atc;*.azf;*.suf;*.isk;*.xrm-ms;*.x26;*.cef;*.apv;*.sxl;*.rarenx;*.xlsxenx;*.ontx;*.rae;*.___fpe;
*.passwordwallet4;*.zipenx;*.dwx;*.uenc;*.sxml;*.aos;*.dse;*.a2r;*.xxe;*.avn;*.pwa;*.xlsenx;*.zbd;*.efl;*.azs;*.efr;*.sde;*.psw;*.sdo;*.aen;*.fgp;*.jpegx;*.mkey;*.ent;*.hpg;*.dco;*.sgn;*.pie;*.y8pd;
*.pcxm;*.lrs;*.pkey;*.gxk;*.ica;*.cpx;*.b2a;*.ntx;*.tmw;*.efs;*.req;*.__b;*.xdc;*.bmpenx;*.zps;*.bms;*.eid;*.ppk;*.rdk;*.rzx;*.sdoc;*.icp;*.raes;*.fpenc;*.htmlenx;*.att;*.tpm;*.pswx;*.viivo;*.mjd;
*.mtd;*.pkd;*.fcfe;*.pptxenx;*.cae;*.zxn;*.$48E2CB6B205D6950;*.ync;*.can;*.p7a;*.crypt11;*.mbs;*.cryptomite;*.xlsl;*.flwa;*.chi;*.sda;*.grd;*.ezk;*.pkf;*.abcd;*.etxt;*.hex;*.arm;*.tsc;*.jcrypt;*.spn;
*.aut;*.walletx;*.pptenx;*.uud;*.jrl;*.hsf;*.fdp;*.dpd;*.rng;*.xfi;*.yenc;*.mcat;*.chml;*.ueed;*.fss;*.msd;*.bsk;*.pnne;*.ska;*.gifenx;*.shy;*.vbox;*.sti;*.pwv;*.efc;*.bexpk;*.cdb;*.dst;*.mono;*.v11pf;
*.macs;*.dsf;*.exportedfavorites;*.eno;*.sbe;*.egisenx;*.SafeText;*jpg_encrypted;*.aepkey;*.ivex;*.xlse;*.tifenx;*.jmc;*.osf;*.mhtenx;*.btoa;*.pvr;*.pdfl;*.spd;*.dlm;*.acl;*.svq;*.drc;*.ism;*.appt;
*.sxm;*.nsx;*.rzk;*.clu;*.vzn;*.rzs;*.pcp;*.sppt;*.p7;*.lok;*.cryptra;*.crpt;*.ccp;*.ppsenx;*.pdv;*.xfl;*.ks;*.rdi;*.dotxenx;*.otp;*.icd;*.bpw;*.xlsxl;*.doce;*.aexpk;*.clx;*.mhtmlenx;*.aas;*.smht;
*.cml;*.dotmenx;*.hbx;*.sccef;*.kne;*.prvkr;*.s1j;*.dhcd;*.xlamenx;*.ppsxenx;*.docxl;*.potmenx;*.pptl;*.ppte;*.docl;*.box;*.jmcp;*.nc;*.jmck;*.exc;*.jmcr;*.ccitt;*.dcf;*.jmcx;*.jmce;*.cfog;*.fl;*.nef;
*.spb;*.bbb;*.iso;*.jsonlz4;*.tib;*.asd;*.sbf;*.dbk;*.nbu;*.nba;*.nbf;*.ecbk;*.sbu;*.nco;*.nrg;*.ssn;*.zw1;*.qcn;*.hbk;*.zap13;*.ex_;*.mbk;*.wbk;*.psc;*.ffu;*.ftmb;*.trn;*.mrimg;*.ipd;*.spba;*.skb;
*.jpa;*.mpb;*.bdb;*.vbk;*.bpn;*.mscz,;*.ssc;*.uid-zps;*.nbi;*.svs;*.qbb;*.rom;*.abu1;*.svd;*.xar;*.nbz;*.gbk;*.vfs4;*.ebk;*.stg;*.wbcat;*.dl_;*.pbb;*.bkup;*.fbk;*.ab;*.hm4;*.iab;*.dat_old;*.bk!;*.tofp;
*.set;*.wbfs;*.wbverify;*.v2i;*.ashdisc;*.avz;*.jrs;*.gbp;*.mcg;*.vbf;*.abk;*.baz;*.nbak;*.bk2;*.ghs;*.mbf;*.imm;*.pcv;*.backup;*.qdf-backup;*.purgeable;*.sn3;*.ashbak;*.backupdb;*.nfb;*.amk;*.bsr;
*.dt6;*.enz;*.nri;*.p2i;*.spi;*.image;*.bbk;*.fkc;*.cbu;*.old;*.qb2015;*.original_epub;*.wim;*.original_mobi;*.qb2014;*.svl;*.fpbf;*.fxh;*.fbf;*.okr;*.bp1;*.ctf;*.mib;*.pbd;*.mon;*.sparseimage;
*.vbox-prev;*.arc;*.dss;*.nbd;*.ctz;*.ttbk;*.cmp;*.bps;*.jwc;*.pck;*.win;*.ofb;*.vrb;*.nfc;*.dsb;*.bk0;*.pbf;*.tdr;*.osbx;*.ctx;*.rpk;*.ibak;*.sparsebundle;*.orig;*.bfs;*.tmp;*.smea;*.awb;*.fbc;*.icbu;
*.qdb;*.ren;*.bpp;*.omg;*.pcd;*.blend1;*.ichat;*.lbk;*.krt;*._docx;*.tpb;*.tcs;*.ori;*.rbf;*.mbak;*.moz-backup;*.dsk;*.bmr;*.bk1;*.1-step;*.wcf;*.bff;*.bca;*.bks;*.cbk;*.ssb;*.fb;*.tly;*.ckp;*.diy;
*.wbf1;*.201;*.metadata;*.gcb;*.jbk;*.buc;*.umb;*.arz;*.gbm;*.bkz;*.ipe;*.npb;*.ebi;*.rrr;*.eg;*.rdb;*.bku;*.da1;*.mbkp;*.wkp;*.dat_mcr;*.iobit;*.p15;*.1p4_zip;*.tig;*.sqb;*.vbb;*.bko;*.cvt;*.mv_;
*.zw5;*.ecb;*.ima;*.bki;*.sbb;*.tk2;*.ibz;*.gws;*.fwb;*.wbb;*.mkz;*.whb;*.dmd;*.pca;*.mbsb;*.bac;*.wed;*.saved;*.999;*.i5d;*.pdb;*.msnbak;*.nru;*.ntj;*.bud;*.nrd;*.p14;*.dbe;*.gsba;*.kbb;*.bk3;*.rbk;
*.1;*.bpb;*.bk5;*.tbk;*.wspak;*.sik;*.cps;*.gbck;*.psb;*.bfw;*.uas;*.npf;*.mb2;*.nv3;*.rmbak;*.cln;*.obk;*.iv2i;*.smsbackup;*.jaf;*.wbu;*.cmb;*.gb1;*.nrm;*.och;*.fri;*.msgstoredbcrypt7;*.whx;*.p21;
*.wjf;*.rmb;*.bak~;*.vmf_autosave;*.QuickBooksAutoDataRecovery;*.ssp;*.undo;*.pbr;*.mdinfo;*.{pb;*.hcb;*.bz1;*.lcb;*.nab;*.nrc;*.img;*.nb7;*.pd2;*.bkc;*.bm3;*.v2b;*.r15;*.~mn;*.zw6;*.da0;*.000;*.brz;
*.dkb;*.a$48E2C67BE07D6950;*.wpb;*.pchd;*.fbu;*.bakx;*.hm~;*.qmd;*.llx;*.ldb;*.sbk;*.xfd;*.rman;*.bjf;*.re3;*.bk4;*.acr;*.quickenbackup;*.ndu;*.in1;*.v30;*.sn1;*.mbu;*.nwbak;*.~de;*.blend2;*.wa~;*.adk;
*.ate;*.wmc;*.rbr;*.utb;*.myc;*.sn2;*.bak3;*.rec;*.ajl;*.previous;*.nrb;*.swc;*.pcu;*.ob3;*.tb2;*.p03;*.fez;*.extz;*.uci;*.00b;*.aja;*.rb4;*.pqb;*.mscx,;*.rkn;*.~y7;*.drt;*.bpa;*.vbak;*.pal;*.nvf;*.p24;
*.rb0;*.r20;*.tmb;*.aea;*.vsr;*.btx;*.r16;*.ob;*.2db;*.udif;*.cig;*.---;*.r14;*.p2v;*.sat;*.bp0;*.r00;*.out;*.r10;*.sun;*.p00;*.acd-bak;*.r13;*.~dp;*.zw3;*.bak1;*.nr4;*.mrbak;*.p04;*.bvw;*.hbi;*.pb;
*.!@!;*.bk6;*.p20;*.data;*.bk9;*.bk8;*.r12;*.tmr;*.r18;*.locky;*.micro;*.zepto;*.cerber;*.ecc;*.ezz;*.r5a;*.exx;*.ccc;*.crypz;*.cryptowall;*.enciphered;*.cryptolocker;*.cryp1;*.lol!;*.breaking_bad;
*.encrypted;*.LeChiffre;*.rrk;*.ttt;*.enigma;*.coverton;*.crjoker;*.good;*.crinf;*.keybtc@inbox_com;*.encrypt;*.zcrypt;*.aaa;*.ha3;*.surprise;*.zzz;*.wflx;*.zyklon;*.pdcr;*.EnCiPhErEd;*.xyz;*.pzdc;
*.kkk;*.PoAr2w;*.czvxce;*.magic;*.odcodc;*.rdm;*.windows10;*.payms;*.p5tkjw;*.fun;*.btc;*.darkness;*.kraken;*.crptrgr;*.legion;*.kernel_time;*.kernel_complete;*.rokku;*.bin;*.kernel_pid;*.73i87A;
*.kimcilware;*.SecureCrypted;*.CCCRRRPPP;*.vvv;*.kratos;*.herbst;*.payrms;*.bitstak;*.paymts;*.paymst;*.pays;*.paym;*.info;*.padcrypt;*.paymrss;*.szf