Maze (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.maze (Back to overview)

Maze

aka: ChaCha

Actor(s): FIN6, TA2101

Maze Ransomware encrypts files and makes them inaccessible while adding a custom extension containing part of the ID of the victim. The ransom note is placed inside a text file and an htm file. There are a few different extensions appended to files which are randomly generated.

Actors are known to exfiltrate the data from the network for further extortion. It spreads mainly using email spam and various exploit kits (Spelevo, Fallout).

The code of Maze ransomware is highly complicated and obfuscated, which helps to evade security solutions using signature-based detections.

References

2020-09-17 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Maze ransomware now encrypts via virtual machines to evade detection
Maze

2020-09-17 ⋅ SophosLabs Uncut ⋅ Andrew Brandt, Peter Mackenzie
Maze attackers adopt Ragnar Locker virtual machine technique
Maze

2020-09-01 ⋅ Cisco Talos ⋅ David Liebenberg, Caitlin Huey
Quarterly Report: Incident Response trends in Summer 2020
Cobalt Strike LockBit Mailto Maze Ryuk

2020-08-13 ⋅ SentinelOne ⋅ SentinelLabs
Case Study: Catching a Human-Operated Maze Ransomware Attack In Action
Maze

2020-08-04 ⋅ ZDNet ⋅ Catalin Cimpanu
Ransomware gang publishes tens of GBs of internal data from LG and Xerox
Maze

2020-08 ⋅ Temple University ⋅ CARE
Critical Infrastructure Ransomware Attacks
CryptoLocker Cryptowall DoppelPaymer FriedEx Mailto Maze REvil Ryuk SamSam WannaCryptor

2020-07-29 ⋅ ESET Research ⋅ welivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos Ransomware PlugX Pony REvil Socelars STOP Ransomware Tinba TrickBot WannaCryptor

2020-07-22 ⋅ SentinelOne ⋅ Jason Reaves, Joshua Platt
Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW)
ISFB Maze TrickBot Zloader

2020-07-15 ⋅ FireEye ⋅ Nathan Brubaker, Daniel Kapellmann Zafra, Keith Lunden, Ken Proska, Corey Hildebrandt
Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families
DoppelPaymer LockerGoga Maze MegaCortex Nefilim Ransomware Snake Ransomware

2020-06-18 ⋅ Quick Heal ⋅ Preksha Saxena
Maze ransomware continues to be a threat to the consumers
Maze

2020-06-17 ⋅ Cognizant ⋅ Cognizant
Notice of Data Breach
Maze

2020-06-16 ⋅ BleepingComputer ⋅ Sergiu Gatlan
Chipmaker MaxLinear reports data breach after Maze Ransomware attack
Maze

2020-06-04 ⋅ Sophos Naked Security ⋅ Lisa Vaas
Nuclear missile contractor hacked in Maze ransomware attack
Maze

2020-05-21 ⋅ BrightTALK (FireEye) ⋅ Kimberly Goody, Jeremy Kennelly
Navigating MAZE: Analysis of a Rising Ransomware Threat
Maze

2020-05-07 ⋅ FireEye Inc ⋅ Kimberly Goody, Jeremy Kennelly, Joshua Shilko
Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents
Maze

2020-05-07 ⋅ REDTEAM.PL ⋅ Adam Ziaja
Sodinokibi / REvil ransomware
Maze MimiKatz REvil

2020-05-04 ⋅ Blueliv ⋅ Blueliv Team
Escape from the Maze
Maze

2020-05-01 ⋅ CrowdStrike ⋅ Shaun Hurley
The Many Paths Through Maze
Maze

2020-04-28 ⋅ Microsoft ⋅ Microsoft Threat Protection Intelligence Team
Ransomware groups continue to target healthcare, critical services; here’s how to reduce risk
LockBit Mailto Maze MedusaLocker Paradise Ransomware RagnarLocker REvil RobinHood

2020-04-18 ⋅ Cognizant ⋅ Cognizant
Cognizant Security Incident Update
Maze

2020-04-18 ⋅ Bleeping Computer ⋅ Lawrence Abrams
IT services giant Cognizant suffers Maze Ransomware cyber attack
Maze

2020-03-26 ⋅ TechCrunch ⋅ Zack Whittaker
Cyber insurer Chubb had data stolen in Maze ransomware attack
Maze

2020-03-26 ⋅ McAfee ⋅ Alexandre Mundo
Ransomware Maze
Maze

2020-03-25 ⋅ Bitdefender ⋅ Bitdefender Team
A Technical Look into Maze Ransomware
Maze

2020-03-24 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Three More Ransomware Families Create Sites to Leak Stolen Data
Clop DoppelPaymer Maze Nefilim Ransomware Nemty REvil

2020-03-12 ⋅ Cyberbit ⋅ Dor Neemani, Omer Fishel, Hod Gavriel
Lost in the Maze
Maze

2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Ransomware Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot vidar Winnti ANTHROPOID SPIDER Anunak APT31 APT39 BlackTech BuhTrap Charming Kitten CLOCKWORD SPIDER DOPPEL SPIDER Gamaredon Group Leviathan MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER Pinchy Spider Pirate Panda Salty Spider SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER

2020-03-03 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Ransomware Attackers Use Your Cloud Backups Against You
DoppelPaymer Maze

2020-01-30 ⋅ ZATAZ ⋅ Damien Bancal
Cyber attaque à l’encontre des serveurs de Bouygues Construction
Maze

2020-01-29 ⋅ ANSSI ⋅ ANSSI
État de la menace rançongiciel
Clop Dharma FriedEx Gandcrab LockerGoga Maze MegaCortex REvil RobinHood Ryuk SamSam

2020-01-22 ⋅ Deloitte ⋅ Deloitte
Project Lurus
Maze

2020 ⋅ Secureworks ⋅ SecureWorks
GOLD VILLAGE
Maze

2019-12-24 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Maze Ransomware Releases Files Stolen from City of Pensacola
Maze

2019-12-18 ⋅ Github (albertzsigovits) ⋅ Albert Zsigovits
Maze ransomware
Maze

2019-12-17 ⋅ Cisco ⋅ JJ Cummings, Dave Liebenberg
Incident Response lessons from recent Maze ransomware attacks
Maze

2019-12-16 ⋅ KrebsOnSecurity ⋅ Brian Krebs
Ransomware Gangs Now Outing Victim Businesses That Don’t Pay Up
Maze

2019-12-11 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Maze Ransomware Behind Pensacola Cyberattack, $1M Ransom Demand
Maze

2019-11-21 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Allied Universal Breached by Maze Ransomware, Stolen Data Leaked
Maze

2019-11-14 ⋅ Proofpoint ⋅ Bryan Campbell, Proofpoint Threat Insight Team
TA2101 plays government imposter to distribute malware to German, Italian, and US organizations
Maze TA2101

2019-11-08 ⋅ Twitter (@certbund) ⋅ CERT-Bund
Tweet on Spam Mails containing MAZE
Maze

2019-10-18 ⋅ Bleeping Computer ⋅ Sergiu Gatlan
Maze Ransomware Now Delivered by Spelevo Exploit Kit
Maze

2019-05-13 ⋅ Amigo A
ChaCha Ransomware
Maze

Yara Rules

[TLP:WHITE] win_maze_auto (20200817 | autogenerated rule brought to you by yara-signator)

rule win_maze_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-08-17"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maze"
        malpedia_rule_date = "20200817"
        malpedia_hash = "8c895fd01eccb47a6225bcb1a3ba53cbb98644c5"
        malpedia_version = "20200817"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b4d10 8b450c f3aa 61 8945f0 c745f000000000 8b45f0 }
            // n = 7, score = 2100
            //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   f3aa                 | rep stosb           byte ptr es:[edi], al
            //   61                   | popal               
            //   8945f0               | mov                 dword ptr [ebp - 0x10], eax
            //   c745f000000000       | mov                 dword ptr [ebp - 0x10], 0
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]

        $sequence_1 = { 8945f0 c745f000000000 8b45f0 83c410 5e 5f 5b }
            // n = 7, score = 2100
            //   8945f0               | mov                 dword ptr [ebp - 0x10], eax
            //   c745f000000000       | mov                 dword ptr [ebp - 0x10], 0
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]
            //   83c410               | add                 esp, 0x10
            //   5e                   | pop                 esi
            //   5f                   | pop                 edi
            //   5b                   | pop                 ebx

        $sequence_2 = { 894de8 8955e4 7509 c745f000000000 eb17 60 }
            // n = 6, score = 2100
            //   894de8               | mov                 dword ptr [ebp - 0x18], ecx
            //   8955e4               | mov                 dword ptr [ebp - 0x1c], edx
            //   7509                 | jne                 0xb
            //   c745f000000000       | mov                 dword ptr [ebp - 0x10], 0
            //   eb17                 | jmp                 0x19
            //   60                   | pushal              

        $sequence_3 = { 89e5 53 57 56 83ec10 8b4510 8b4d0c }
            // n = 7, score = 2100
            //   89e5                 | mov                 ebp, esp
            //   53                   | push                ebx
            //   57                   | push                edi
            //   56                   | push                esi
            //   83ec10               | sub                 esp, 0x10
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]

        $sequence_4 = { 8b4510 8b4d0c 8b5508 837d0800 }
            // n = 4, score = 2100
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   837d0800             | cmp                 dword ptr [ebp + 8], 0

        $sequence_5 = { 8b5508 837d0800 8945ec 894de8 8955e4 7509 }
            // n = 6, score = 2100
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   837d0800             | cmp                 dword ptr [ebp + 8], 0
            //   8945ec               | mov                 dword ptr [ebp - 0x14], eax
            //   894de8               | mov                 dword ptr [ebp - 0x18], ecx
            //   8955e4               | mov                 dword ptr [ebp - 0x1c], edx
            //   7509                 | jne                 0xb

        $sequence_6 = { c745f000000000 eb17 60 8b7d08 8b4d10 8b450c f3aa }
            // n = 7, score = 2100
            //   c745f000000000       | mov                 dword ptr [ebp - 0x10], 0
            //   eb17                 | jmp                 0x19
            //   60                   | pushal              
            //   8b7d08               | mov                 edi, dword ptr [ebp + 8]
            //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   f3aa                 | rep stosb           byte ptr es:[edi], al

        $sequence_7 = { 2344240c 09c6 89f8 8b7c2418 }
            // n = 4, score = 2000
            //   2344240c             | and                 eax, dword ptr [esp + 0xc]
            //   09c6                 | or                  esi, eax
            //   89f8                 | mov                 eax, edi
            //   8b7c2418             | mov                 edi, dword ptr [esp + 0x18]

        $sequence_8 = { 41 41 41 41 41 41 }
            // n = 6, score = 1500
            //   41                   | inc                 ecx
            //   41                   | inc                 ecx
            //   41                   | inc                 ecx
            //   41                   | inc                 ecx
            //   41                   | inc                 ecx
            //   41                   | inc                 ecx

        $sequence_9 = { 1109 7437 1b0f 0033 37 }
            // n = 5, score = 100
            //   1109                 | adc                 dword ptr [ecx], ecx
            //   7437                 | je                  0x39
            //   1b0f                 | sbb                 ecx, dword ptr [edi]
            //   0033                 | add                 byte ptr [ebx], dh
            //   37                   | aaa                 

        $sequence_10 = { c1e217 8b45fc 8b4d08 8b848120080000 c1e809 0bd0 }
            // n = 6, score = 100
            //   c1e217               | shl                 edx, 0x17
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   8b848120080000       | mov                 eax, dword ptr [ecx + eax*4 + 0x820]
            //   c1e809               | shr                 eax, 9
            //   0bd0                 | or                  edx, eax

        $sequence_11 = { 33c0 5d c3 8b04c5e4324100 5d c3 }
            // n = 6, score = 100
            //   33c0                 | xor                 eax, eax
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   8b04c5e4324100       | mov                 eax, dword ptr [eax*8 + 0x4132e4]
            //   5d                   | pop                 ebp
            //   c3                   | ret                 

        $sequence_12 = { 5e 5b 8be5 5d c3 7501 }
            // n = 6, score = 100
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   7501                 | jne                 3

        $sequence_13 = { 8b7508 8b4c8ef8 c1e913 0bd1 33c2 }
            // n = 5, score = 100
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   8b4c8ef8             | mov                 ecx, dword ptr [esi + ecx*4 - 8]
            //   c1e913               | shr                 ecx, 0x13
            //   0bd1                 | or                  edx, ecx
            //   33c2                 | xor                 eax, edx

        $sequence_14 = { 0bd0 899540ffffff b904000000 6bd106 8b4508 8b8c1000100000 }
            // n = 6, score = 100
            //   0bd0                 | or                  edx, eax
            //   899540ffffff         | mov                 dword ptr [ebp - 0xc0], edx
            //   b904000000           | mov                 ecx, 4
            //   6bd106               | imul                edx, ecx, 6
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b8c1000100000       | mov                 ecx, dword ptr [eax + edx + 0x1000]

        $sequence_15 = { 8b55fc 8b7508 8b949624080000 89940140100000 8b45fc 8b4d08 }
            // n = 6, score = 100
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   8b949624080000       | mov                 edx, dword ptr [esi + edx*4 + 0x824]
            //   89940140100000       | mov                 dword ptr [ecx + eax + 0x1040], edx
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]

        $sequence_16 = { 8b4508 8b8c1040100000 c1e108 ba04000000 c1e203 }
            // n = 5, score = 100
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b8c1040100000       | mov                 ecx, dword ptr [eax + edx + 0x1040]
            //   c1e108               | shl                 ecx, 8
            //   ba04000000           | mov                 edx, 4
            //   c1e203               | shl                 edx, 3

    condition:
        7 of them and filesize < 2318336
}

Download all Yara Rules

Maze Propose Change

References

Yara Rules

Maze