My analysis started out with looking at the “Grattis.exe” executable and after looking at embedded strings I was lead to believe that this indeed was an AutoIt script. This AutoIt code is also heavily obfuscated to prevent analysis.

AutoIt programs are written in a language similar BASIC and can be compiled to a self-hosted executable. The ransomware is written with AutoIt 3, a system used by system administrators to automate various tasks in a computer. More background can be found in this article from Bleeping Computer. It has been seen in the wild since around October 2016. This version was released after “Stampado” was broken by Fabian Wosar at Emisoft. It’s a successor to another ransomware called “Stampado” by the same author, “The Rainmaker”. The configuration parameters include things like which file types it targets, whether it will try to infect USB-drives or network shares and which command & control servers it should contact. It is a crimekit selling for about $400 and can be configured by the user before being unleashed on victims. The Philadelphia ransomware is a rather simple ransomware. All three of the files contain a Ransomware called “Philadelphia Ransomware”. Note the three bytes in the middle “e280ae” which corresponds to Unicode codepoint U+202E, RIGHT-TO-LEFT OVERRIDE which, in for example Windows Explorer, make it look like the files are called “aPassT.txt” and “PassT.txt” respectively thus tricking the user to click them thinking that they are only regular text files. The hex encoded filenames are shown in the table below: Hex-encoded filename The first two files actually have some special characters in their names which are not shown above. The USB-drive contained three copies of the same Windows PE executable. What follows is my analysis of the USB-drive and the malware contained in it.

Through contacts in the Swedish security community, I managed to get a copy of the contents of the drive and could analyze it. Being a strong opponent to the FUD that is very commonly spread in security related events I sought to dig deeper into this. All of this, of course, without any kind of evidence to back it up. This quickly spread in social media and all kinds of wild theories started to appear including industrial espionage and Russian hackers using “military-grade encryption”. It was reported by, among others, IDG, Expressen, SVT and even far-right sites such as Nordfront.

This Wednesday reports about USB-drives with malicious code being found in the area Lindholmen in Gothenburg, spread in Swedish media. Reversing malware USB drives in Gothenburg

Decompiling an autoit exe