Posted By kwonxx , February 1, 2023

TZW Ransomware Being Distributed in Korea

Through internal monitoring, the ASEC analysis team recently discovered the distribution of the TZW ransomware, which encrypts files before adding the “TZW” file extension to the original extension.

This ransomware is being propagated with the version info marked as “System Boot Info”, disguising itself as a normal program file related to boot information.

It was created in a .NET format and includes a loader and the actual ransomware data within it. It ultimately loads and executes the ransomware file through the loader. Among the data in the resources, it decodes and runs ‘dVvYsaL’ on the memory. This data holds the loader and ransomware data. Such a method has been covered in a previous ASEC blog post.

Types of Recent .NET Packers and Their Distribution Trends in Korea

The resource area also holds pornographic photos and the contents are shown in Figure 2 below.

Figure 2. Resources including the loader file

The additionally executed loader file drops a copy under the name ‘GvsqHuTYODA.exe’ into the %AppData% directory and proceeds with task scheduler registration.

schtasks.exe /Create /TN “Updates\GvsqHuTYODA” /XML “%Temp%\tmpF6C.tmp”

Figure 5. Registering to the task scheduler

After registering to the task scheduler, the file recursively executes the PE file that performs the ransomware behavior along with the “{path}” parameter to encode files.

Figure 6. The ultimately executed ransomware

The executed process goes through a logic to check for a virtual environment before infecting the system.

Figure 7. Logic to check for virtual environment

Figure 8. Logic to check for virtual environment

Afterward, to expand the range of infection, it goes through a logic that checks the drive information before moving on to the file encryption routine.

The file encryption process is made up of the thread that encrypts shared folders and the thread that encrypts the local environment.

Figure 11. Part of the shared folder encryption code

File encryption is conducted on all folders aside from the Windows folder, and after encryption, volume shadows are deleted to hinder system recovery.

The following ‘ReadMe.txt’ ransom note can be found in the path where file encryption occurred. The string “CRYPTO LOCKER” is found at the end of infected files.

Figure 15. Infected file

AhnLab’s anti-malware software, V3, detects and responds to PE files used in TZW file extension ransomware with a variety of detection points, including file detection and behavior-based detection. To prevent ransomware infection, users must be cautious of running files from unknown sources and make sure to scan suspicious files with an anti-malware program while also keeping the program updated to the latest version. AhnLab’s anti-malware software, V3, detects and blocks the malware using the following aliases:

[File Detection]