Maze (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.maze (Back to overview)

Maze

aka: ChaCha

Actor(s): FIN6, TA2101

Maze Ransomware encrypts files and makes them inaccessible while adding a custom extension containing part of the ID of the victim. The ransom note is placed inside a text file and an htm file. There are a few different extensions appended to files which are randomly generated.

Actors are known to exfiltrate the data from the network for further extortion. It spreads mainly using email spam and various exploit kits (Spelevo, Fallout).

The code of Maze ransomware is highly complicated and obfuscated, which helps to evade security solutions using signature-based detections.

References

2020-06-18 ⋅ Quick Heal ⋅ Preksha Saxena
Maze ransomware continues to be a threat to the consumers
Maze

2020-06-17 ⋅ Cognizant ⋅ Cognizant
Notice of Data Breach
Maze

2020-06-16 ⋅ BleepingComputer ⋅ Sergiu Gatlan
Chipmaker MaxLinear reports data breach after Maze Ransomware attack
Maze

2020-06-04 ⋅ Sophos Naked Security ⋅ Lisa Vaas
Nuclear missile contractor hacked in Maze ransomware attack
Maze

2020-05-21 ⋅ BrightTALK (FireEye) ⋅ Kimberly Goody, Jeremy Kennelly
Navigating MAZE: Analysis of a Rising Ransomware Threat
Maze

2020-05-07 ⋅ FireEye Inc ⋅ Kimberly Goody, Jeremy Kennelly, Joshua Shilko
Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents
Maze

2020-05-07 ⋅ REDTEAM.PL ⋅ Adam Ziaja
Sodinokibi / REvil ransomware
Maze MimiKatz REvil

2020-05-04 ⋅ Blueliv ⋅ Blueliv Team
Escape from the Maze
Maze

2020-05-01 ⋅ CrowdStrike ⋅ Shaun Hurley
The Many Paths Through Maze
Maze

2020-04-28 ⋅ Microsoft ⋅ Microsoft Threat Protection Intelligence Team
Ransomware groups continue to target healthcare, critical services; here’s how to reduce risk
LockBit Mailto Maze MedusaLocker Paradise Ransomware RagnarLocker REvil RobinHood

2020-04-18 ⋅ Cognizant ⋅ Cognizant
Cognizant Security Incident Update
Maze

2020-04-18 ⋅ Bleeping Computer ⋅ Lawrence Abrams
IT services giant Cognizant suffers Maze Ransomware cyber attack
Maze

2020-03-26 ⋅ TechCrunch ⋅ Zack Whittaker
Cyber insurer Chubb had data stolen in Maze ransomware attack
Maze

2020-03-26 ⋅ McAfee ⋅ Alexandre Mundo
Ransomware Maze
Maze

2020-03-25 ⋅ Bitdefender ⋅ Bitdefender Team
A Technical Look into Maze Ransomware
Maze

2020-03-24 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Three More Ransomware Families Create Sites to Leak Stolen Data
Clop DoppelPaymer Maze Nefilim Ransomware Nemty REvil

2020-03-12 ⋅ Cyberbit ⋅ Dor Neemani, Omer Fishel, Hod Gavriel
Lost in the Maze
Maze

2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze Necurs Nokki Outlook Backdoor Phobos Ransomware Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot vidar Winnti ANTHROPOID SPIDER Anunak APT39 BlackTech BuhTrap Charming Kitten CLOCKWORD SPIDER DOPPEL SPIDER Gamaredon Group Judgment Panda Leviathan MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER Pinchy Spider Pirate Panda Salty Spider SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER

2020-03-03 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Ransomware Attackers Use Your Cloud Backups Against You
DoppelPaymer Maze

2020-01-30 ⋅ ZATAZ ⋅ Damien Bancal
Cyber attaque à l’encontre des serveurs de Bouygues Construction
Maze

2020-01-29 ⋅ ANSSI ⋅ ANSSI
État de la menace rançongiciel
Clop Dharma FriedEx Gandcrab LockerGoga Maze MegaCortex REvil RobinHood Ryuk SamSam

2020-01-22 ⋅ Deloitte ⋅ Deloitte
Project Lurus
Maze

2020 ⋅ Secureworks ⋅ SecureWorks
GOLD VILLAGE
Maze

2019-12-24 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Maze Ransomware Releases Files Stolen from City of Pensacola
Maze

2019-12-18 ⋅ Github (albertzsigovits) ⋅ Albert Zsigovits
Maze ransomware
Maze

2019-12-17 ⋅ Cisco ⋅ JJ Cummings, Dave Liebenberg
Incident Response lessons from recent Maze ransomware attacks
Maze

2019-12-16 ⋅ KrebsOnSecurity ⋅ Brian Krebs
Ransomware Gangs Now Outing Victim Businesses That Don’t Pay Up
Maze

2019-12-11 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Maze Ransomware Behind Pensacola Cyberattack, $1M Ransom Demand
Maze

2019-11-21 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Allied Universal Breached by Maze Ransomware, Stolen Data Leaked
Maze

2019-11-14 ⋅ Proofpoint ⋅ Bryan Campbell, Proofpoint Threat Insight Team
TA2101 plays government imposter to distribute malware to German, Italian, and US organizations
Maze TA2101

2019-11-08 ⋅ Twitter (@certbund) ⋅ CERT-Bund
Tweet on Spam Mails containing MAZE
Maze

2019-10-18 ⋅ Bleeping Computer ⋅ Sergiu Gatlan
Maze Ransomware Now Delivered by Spelevo Exploit Kit
Maze

2019-05-13 ⋅ Amigo A
ChaCha Ransomware
Maze

Yara Rules

[TLP:WHITE] win_maze_auto (20200529 | autogenerated rule brought to you by yara-signator)

rule win_maze_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-05-30"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maze"
        malpedia_rule_date = "20200529"
        malpedia_hash = "92c362319514e5a6da26204961446caa3a8b32a8"
        malpedia_version = "20200529"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83f810 7d32 88441500 c644150300 8d7204 81feff000000 }
            // n = 6, score = 2300
            //   83f810               | cmp                 eax, 0x10
            //   7d32                 | jge                 0x34
            //   88441500             | mov                 byte ptr [ebp + edx], al
            //   c644150300           | mov                 byte ptr [ebp + edx + 3], 0
            //   8d7204               | lea                 esi, [edx + 4]
            //   81feff000000         | cmp                 esi, 0xff

        $sequence_1 = { 09d7 0fb65019 89bc24b0000000 0fb6781c }
            // n = 4, score = 2300
            //   09d7                 | or                  edi, edx
            //   0fb65019             | movzx               edx, byte ptr [eax + 0x19]
            //   89bc24b0000000       | mov                 dword ptr [esp + 0xb0], edi
            //   0fb6781c             | movzx               edi, byte ptr [eax + 0x1c]

        $sequence_2 = { 8b6c2410 55 e8???????? 83c40c 8a442402 b900000000 }
            // n = 6, score = 2300
            //   8b6c2410             | mov                 ebp, dword ptr [esp + 0x10]
            //   55                   | push                ebp
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   8a442402             | mov                 al, byte ptr [esp + 2]
            //   b900000000           | mov                 ecx, 0

        $sequence_3 = { 894c2418 138424f8000000 8b4c2424 89442450 038c244c010000 }
            // n = 5, score = 2300
            //   894c2418             | mov                 dword ptr [esp + 0x18], ecx
            //   138424f8000000       | adc                 eax, dword ptr [esp + 0xf8]
            //   8b4c2424             | mov                 ecx, dword ptr [esp + 0x24]
            //   89442450             | mov                 dword ptr [esp + 0x50], eax
            //   038c244c010000       | add                 ecx, dword ptr [esp + 0x14c]

        $sequence_4 = { 8d842424010000 50 53 8d442464 50 e8???????? }
            // n = 6, score = 2300
            //   8d842424010000       | lea                 eax, [esp + 0x124]
            //   50                   | push                eax
            //   53                   | push                ebx
            //   8d442464             | lea                 eax, [esp + 0x64]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_5 = { 8b442428 8994247c010000 8d0400 89442454 f7eb 8984248c010000 89f0 }
            // n = 7, score = 2300
            //   8b442428             | mov                 eax, dword ptr [esp + 0x28]
            //   8994247c010000       | mov                 dword ptr [esp + 0x17c], edx
            //   8d0400               | lea                 eax, [eax + eax]
            //   89442454             | mov                 dword ptr [esp + 0x54], eax
            //   f7eb                 | imul                ebx
            //   8984248c010000       | mov                 dword ptr [esp + 0x18c], eax
            //   89f0                 | mov                 eax, esi

        $sequence_6 = { 89742458 0fb6701a c1e110 09d1 0fb6501b }
            // n = 5, score = 2300
            //   89742458             | mov                 dword ptr [esp + 0x58], esi
            //   0fb6701a             | movzx               esi, byte ptr [eax + 0x1a]
            //   c1e110               | shl                 ecx, 0x10
            //   09d1                 | or                  ecx, edx
            //   0fb6501b             | movzx               edx, byte ptr [eax + 0x1b]

        $sequence_7 = { 8d840414020000 50 8d442410 50 55 e8???????? 8b44240c }
            // n = 7, score = 2300
            //   8d840414020000       | lea                 eax, [esp + eax + 0x214]
            //   50                   | push                eax
            //   8d442410             | lea                 eax, [esp + 0x10]
            //   50                   | push                eax
            //   55                   | push                ebp
            //   e8????????           |                     
            //   8b44240c             | mov                 eax, dword ptr [esp + 0xc]

        $sequence_8 = { 29d0 8945d4 8d85e8feffff 8d4801 8a10 40 }
            // n = 6, score = 1400
            //   29d0                 | sub                 eax, edx
            //   8945d4               | mov                 dword ptr [ebp - 0x2c], eax
            //   8d85e8feffff         | lea                 eax, [ebp - 0x118]
            //   8d4801               | lea                 ecx, [eax + 1]
            //   8a10                 | mov                 dl, byte ptr [eax]
            //   40                   | inc                 eax

        $sequence_9 = { 6a00 6801001200 ff15???????? 85c0 a3???????? 7533 }
            // n = 6, score = 1400
            //   6a00                 | push                0
            //   6801001200           | push                0x120001
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   a3????????           |                     
            //   7533                 | jne                 0x35

        $sequence_10 = { 50 8d542408 6a04 52 6a00 6a00 }
            // n = 6, score = 1400
            //   50                   | push                eax
            //   8d542408             | lea                 edx, [esp + 8]
            //   6a04                 | push                4
            //   52                   | push                edx
            //   6a00                 | push                0
            //   6a00                 | push                0

        $sequence_11 = { 6a03 53 6a02 6800000040 8d4500 50 }
            // n = 6, score = 1400
            //   6a03                 | push                3
            //   53                   | push                ebx
            //   6a02                 | push                2
            //   6800000040           | push                0x40000000
            //   8d4500               | lea                 eax, [ebp]
            //   50                   | push                eax

        $sequence_12 = { 743e 8d442404 6a00 50 8d542408 6a04 }
            // n = 6, score = 1400
            //   743e                 | je                  0x40
            //   8d442404             | lea                 eax, [esp + 4]
            //   6a00                 | push                0
            //   50                   | push                eax
            //   8d542408             | lea                 edx, [esp + 8]
            //   6a04                 | push                4

        $sequence_13 = { 6800000080 8d4500 50 8b35???????? }
            // n = 4, score = 1400
            //   6800000080           | push                0x80000000
            //   8d4500               | lea                 eax, [ebp]
            //   50                   | push                eax
            //   8b35????????         |                     

        $sequence_14 = { 8b0d???????? 83c8ff 85c9 c744240400000000 }
            // n = 4, score = 1400
            //   8b0d????????         |                     
            //   83c8ff               | or                  eax, 0xffffffff
            //   85c9                 | test                ecx, ecx
            //   c744240400000000     | mov                 dword ptr [esp + 4], 0

        $sequence_15 = { 55 89e5 50 8b4508 31c9 8945fc }
            // n = 6, score = 1400
            //   55                   | push                ebp
            //   89e5                 | mov                 ebp, esp
            //   50                   | push                eax
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   31c9                 | xor                 ecx, ecx
            //   8945fc               | mov                 dword ptr [ebp - 4], eax

        $sequence_16 = { 8b8c0a40100000 c1e918 0bc1 898584feffff ba04000000 6bc206 }
            // n = 6, score = 100
            //   8b8c0a40100000       | mov                 ecx, dword ptr [edx + ecx + 0x1040]
            //   c1e918               | shr                 ecx, 0x18
            //   0bc1                 | or                  eax, ecx
            //   898584feffff         | mov                 dword ptr [ebp - 0x17c], eax
            //   ba04000000           | mov                 edx, 4
            //   6bc206               | imul                eax, edx, 6

        $sequence_17 = { c1e108 ba04000000 c1e203 8b4508 8b941040100000 c1ea18 0bca }
            // n = 7, score = 100
            //   c1e108               | shl                 ecx, 8
            //   ba04000000           | mov                 edx, 4
            //   c1e203               | shl                 edx, 3
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b941040100000       | mov                 edx, dword ptr [eax + edx + 0x1040]
            //   c1ea18               | shr                 edx, 0x18
            //   0bca                 | or                  ecx, edx

        $sequence_18 = { 6bd10f 8b4508 8b8c1000100000 c1e118 ba04000000 }
            // n = 5, score = 100
            //   6bd10f               | imul                edx, ecx, 0xf
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b8c1000100000       | mov                 ecx, dword ptr [eax + edx + 0x1000]
            //   c1e118               | shl                 ecx, 0x18
            //   ba04000000           | mov                 edx, 4

        $sequence_19 = { 8b4508 8b8c0840100000 c1e916 0bd1 8995e8fdffff }
            // n = 5, score = 100
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b8c0840100000       | mov                 ecx, dword ptr [eax + ecx + 0x1040]
            //   c1e916               | shr                 ecx, 0x16
            //   0bd1                 | or                  edx, ecx
            //   8995e8fdffff         | mov                 dword ptr [ebp - 0x218], edx

        $sequence_20 = { c1e810 8845e6 0fb64de7 0fb655e6 8b4508 8b8c8800080000 }
            // n = 6, score = 100
            //   c1e810               | shr                 eax, 0x10
            //   8845e6               | mov                 byte ptr [ebp - 0x1a], al
            //   0fb64de7             | movzx               ecx, byte ptr [ebp - 0x19]
            //   0fb655e6             | movzx               edx, byte ptr [ebp - 0x1a]
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b8c8800080000       | mov                 ecx, dword ptr [eax + ecx*4 + 0x800]

        $sequence_21 = { 8b5508 8b848a08080000 038584feffff 8b8d8cfeffff 338d88feffff 03c1 338580feffff }
            // n = 7, score = 100
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   8b848a08080000       | mov                 eax, dword ptr [edx + ecx*4 + 0x808]
            //   038584feffff         | add                 eax, dword ptr [ebp - 0x17c]
            //   8b8d8cfeffff         | mov                 ecx, dword ptr [ebp - 0x174]
            //   338d88feffff         | xor                 ecx, dword ptr [ebp - 0x178]
            //   03c1                 | add                 eax, ecx
            //   338580feffff         | xor                 eax, dword ptr [ebp - 0x180]

        $sequence_22 = { c1e009 8b4dfc 8b5508 8b4c8a10 c1e917 }
            // n = 5, score = 100
            //   c1e009               | shl                 eax, 9
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   8b4c8a10             | mov                 ecx, dword ptr [edx + ecx*4 + 0x10]
            //   c1e917               | shr                 ecx, 0x17

        $sequence_23 = { c1e118 ba04000000 6bc207 8b5508 8b840200100000 c1e808 0bc8 }
            // n = 7, score = 100
            //   c1e118               | shl                 ecx, 0x18
            //   ba04000000           | mov                 edx, 4
            //   6bc207               | imul                eax, edx, 7
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   8b840200100000       | mov                 eax, dword ptr [edx + eax + 0x1000]
            //   c1e808               | shr                 eax, 8
            //   0bc8                 | or                  ecx, eax

    condition:
        7 of them and filesize < 2318336
}

Download all Yara Rules

Maze Propose Change

References

Yara Rules

Maze