CashRansomware

The sample is a .NET PE executable intended to be executed manually.

If no network communication is available, CashRansomware adapts by storing the decryption key in the registry

The software copies itself to the Start Menu’s Programs Startup folder, automatically executing each time the system boots up.

The software copies itself to the Start Menu’s Programs Startup folder, automatically executing each time the system boots up.

The data flow and control flow of the sample are obfuscated using Eziriz .NET Reactor.

It also detects the presence of sandboxie and any.run sandbox... The malware has anti VM features and can detect if the “Manifacturer” contains “microsoft corporation” or “vmware”

CashRansomware is programmed to avoid infecting systems located in Russia and other Commonwealth of Independent States (CIS) countries. This selective targeting is achieved through geolocation checks and system language settings

The malware employs time-stomping techniques to detect the presence of a sandbox environment. By manipulating file timestamps or monitoring system clock discrepancies, it can identify anomalies that are typical of the execution of a sandbox.

The malware includes a very simple anti-debugging function.

If no network communication is available, CashRansomware adapts by storing the decryption key in the registry

Every device connected to the compromised computer is systematically explored by enumerating drive letters. This process allows the malware to identify and target additional storage devices, such as external hard drives, USB drives, and network shares

It also detects the presence of sandboxie and any.run sandbox... The malware has anti VM features and can detect if the “Manifacturer” contains “microsoft corporation” or “vmware”

CashRansomware is programmed to avoid infecting systems located in Russia and other Commonwealth of Independent States (CIS) countries. This selective targeting is achieved through geolocation checks and system language settings

The malware employs time-stomping techniques to detect the presence of a sandbox environment. By manipulating file timestamps or monitoring system clock discrepancies, it can identify anomalies that are typical of the execution of a sandbox.

The malware includes a very simple anti-debugging function.

Every device connected to the compromised computer is systematically explored by enumerating drive letters... external hard drives, USB drives, and network shares, to maximize the scope of its encryption campaign.

The sample establishes communication with its command and control (C2) server through the encrypted messaging platform Telegram.

As the ransomware is communicating the new victim status over Telegram... it is possible to intercept the API key from the ransomware and directly communicate with the API.

It autonomously encrypts files on the infected system and subsequently displays a pop-up window demanding cryptocurrency payment for decryption.

The sample is able to delete system restore points as part of its evasion and persistence strategy.

In addition to encrypting files and displaying a ransom note, CashRansomware also modifies the desktop wallpaper to reinforce its presence and demand for ransom.