The Cybereason Global Security Operations Center (SOC) Team issues Cybereason Threat Alerts to inform customers of emerging impacting threats. The Alerts summarize these threats and provide practical recommendations for protecting against them. In this article, the Cybereason Research team exposes Redeemer 2.0, an updated version of the original ransomware.
The malware dubbed Redeemer 2.0 is an updated variant of the Redeemer ransomware. This version differs from its older variants as it:
In this article, Cybereason Security Research Team analyzed the new release of this ransomware and how to defend against it through the Cybereason Defense Platform.
A new and improved Redeemer 2.0 ransomware version was released on an underground forum. The author, calling himself “Cerebrate”, describes the new version as a “C++ no dependency ransomware with no privacy intrusions”, targeting the Windows OS:
Underground forum screenshot
The Redeemer 2.0 ransomware build can be generated using the toolkit as shown in this video:
Redeemer 2.0 Ransomware Builder
The build of the ransomware copies itself into the Windows directory with legitimate file names and executes itself as a new process, for example sqlserver1.exe, svchost.exe, etc.
The Cybereason Defense Platform Anti-Malware capability detects and prevents the ransomware execution:
MalOp Management screen as seen in the Cybereason Defense Platform
The new process executed by the Redeemer build was detected and prevented by Anti-Ransomware:
MalOp Management screen as seen in the Cybereason Defense Platform
When Anti-Ransomware is set to “Detect” mode (which means that the ransomware is detected but not prevented on purpose), it is possible to analyze the Redeemer actions on the victim machine:
MalOp process as seen in the Cybereason Defense Platform
Redeemer ransomware 2.0 tries to:
These actions can be observed from in the MalOp details for the process, as shown below:
Example of a command line to kill processes before encryption
Example of a command line to stop services before encryption
Example of a command line to clear the windows event log before encryption
Example of a command line to delete shadow copies
The Cybereason Defense Platform detects and prevents Redeemer 2.0 infections through the Anti-ransomware feature. Cybereason recommends the following:
Mark Tsipershtein, Security Operations Analyst at Cybereason
Mark Tsipershtein, a cyber security analyst at the Cybereason Security Research Team, focuses on analysis automation and infrastructure. Mark has more than 20 years of experience in SQA, automation, and security testing.
The Cybereason Global SOC Team delivers 24/7 Managed Detection and Response services to customers on every continent. Led by cybersecurity experts with experience working for government, the military and multiple industry verticals, the Cybereason Global SOC Team continuously hunts for the most sophisticated and pervasive threats to support our mission to end cyberattacks on the endpoint, across the enterprise, and everywhere the battle moves.
All Posts by Cybereason Global SOC Team
First observed in June 2022 in the wild, HavanaCrypt Ransomware masquerades as a legitimate Google Chrome update with sophisticated anti-analysis techniques and other functionality that may be used for data exfiltration and privilege escalation...
In this Threat Analysis report, Cybereason investigates the Ransomware-as-a-Service (RaaS) known as Beast and how to defend against it through the Cybereason Defense Platform.
