Investigating BlackSuit Ransomware’s Similarities to Royal

Its
operators
also
set
up
a
data
leak
site
as
part
of
their
two-pronged
extortion
strategy
to
coerce
victims
into
paying
the
ransom
demand.
Note
that
there
is
just
a
single
victim
currently
listed
on
the
leak
site
as
of
the
time
of
writing.

One
of
the
BlackSuit
ransomware
samples
we
analyzed
is
an
x64
ESXi
version
targeting
Linux
machines.
An
earlier

post
on
Twitter
revealed
that
YARA
rules
designed
for
BlackSuit’s
Linux
variant
matched
samples
of
the

Royal
ransomware
Linux
variant.

After
comparing
both
samples
of
the
Royal
and
BlackSuit
ransomware,
it
became
apparent
to
us
that
they
have
an
extremely
high
degree
of
similarity
to
each
other.
In
fact,
they’re
nearly
identical,
with
98%
similarities
in
functions,
99.5%
similarities
in
blocks,
and
98.9%
similarities
in
jumps
based
on
BinDiff,
a
comparison
tool
for
binary
files.

Further
analysis
found
that
BlackSuit
employs
command-line
arguments
that
have
a
similar
function
to
those
used
by
Royal.
However,
there
are
some
differences:
The
strings
used
in
the
arguments
are
different,
with
BlackSuit
also
including
additional
arguments
not
found
in
Royal.

Meanwhile,
the

skip
argument
is
used
to
indicate
a
text
file
that
contains
a
list
of
folders
to
be
skipped. 

During
file
enumeration
and
encryption,
each
respective
ransomware
family
avoids
files
with
the
following
extensions
and
filenames:

BlackSuit
ransomware
targets
the
following
extensions
if
the

–allfiles
argument
is
not
provided:

• 
  .vmem
• 
  .vmdk
• 
  .nvram
• 
  .vmsd
• 
  .vmsn
• 
  .vmss
• 
  .vmtm
• 
  .vmxf
• 
  .vmxf
• 
  .vmx

The
binaries
for
both
BlackSuit
and
Royal
use
OpenSSL’s
AES
for
encryption
and
employ

similar
intermittent
encryption
techniques
to
accelerate
the
encryption
of
the
victim’s
files.

Both
BlackSuit
and
Royal
prepare
the
files
for
encryption
by
rounding
up
the
file
size
to
the
nearest
multiple
of
16,
after
which
41
bytes
are
added,
possibly
to
account
for
the
encryption
header
and
other
metadata.

Next,
a
check
is
performed
for
the
file
being
encrypted
to
determine
if
it
has
a
size
that
is
greater
than
0x40000h
(approximately
262KB).
If
this
condition
is
met,
it
will
use
the
value
set
using

-percent,
which
is
represented
here
by
the

i_ep
variable.
If
not,
it
will
use
the
default,
which
is
100.

The
number
of
bytes
to
be
used
for
intermittent
encryption
is
then
calculated
using
the
same
formula
found
in
the
Linux
version
of
Royal
ransomware:

The
file
size
is
again
checked
to
calculate
the
amount
of
space
to
be
allocated
for
the
data
and
metadata.
Finally,
the
keys
to
be
used
for
encryption
are
prepared.

In
the
case
of
BlackSuit,
as
we
previously
mentioned,
it
appends
the
extension
“.blacksuit”
to
encrypted
files
and
drops
a
ransom
note
in
the
directory
where
the
files
are
located.

In
addition
to
the
Linux-based
sample,
we
also
analyzed
a
Windows
32-bit
version
of
BlackSuit,
which
also
exhibits
significant
similarities
with
its
Royal
ransomware
counterpart
(93.2%
similarity
in
functions,
99.3%
in
basic
blocks,
and
98.4%
in
jumps
based
on
BinDiff).

Our
analysis
found
that
BlackSuit
accepts
the
following
command-line
arguments:

While
BlackSuit
introduces
different
argument
strings
compared
to
Royal,
their
purpose
remains
similar.
BlackSuit
combines
arguments
from
various
Windows
versions
of
Royal
Ransomware,
while
also
introducing
new
arguments
such
as
“-delete”
and
“-list”
that
are
specific
to
itself.

The
–delete
argument
uses
the
following
command
to
continuously
check
for
the
existence
of
its
file
by
looking
for
the
filename:

If
the
file
is
found,
it
is
immediately
deleted.
The
command
keeps
running
indefinitely
until
the
file
is
deleted,
at
which
point
the
loop
will
exit.

The

-list
argument
is
used
to
specify
a
text
file
containing
target
directories
to
encrypt.
It
loads
the
file
using

ReadFileFAPI
then
places
the
contents
of
the
text
file
in
a
buffer.
Note
that
the
loaded
text
file
is
a
sample
text
file
we
used
for
testing
and
not
the
format
of
the
text
file
that
will
be
loaded
in
an
actual
attack.

if

–disablesafeboot
is
passed
as
an
argument,
it
removes
the
“safeboot”
value
from
the
current
boot
entry
in
the
Boot
Configuration
Data
(BCD)
and
performs
an
immediate
system
restart
via
the
following
command:

When
encrypting
network
shares
using
the

-network
argument,
BlackSuit
will
check
if
the
IP
address
begins
with
the
following
numbers
to
ensure
that
it
is
encrypting
local
systems:

• 
  192.168.
• 
  10.
• 
  100.
• 
   172.

It
avoids
encrypting
files
with
the
following
strings
in
their
file
path:

BlackSuit
ransomware
also
deletes
shadow
copies
using
the
following
command:

The
emergence
of
BlackSuit
ransomware
(with
its
similarities
to
Royal)
indicates
that
it
is
either
a
new
variant
developed
by
the
same
authors,
a
copycat
using
similar
code,
or
an
affiliate
of
the
Royal
ransomware
gang
that
has
implemented
modifications
to
the
original
family.

One
possibility
for
BlackSuit’s
creation
is
that,
since
the
threat
actors
behind
Royal
(and

Conti
before
it)
are
one
of
the

most
active
ransomware
groups
in
operation
today,
this
may
have
led
to
increased
attention
from
other
cybercriminals,
who
were
then
inspired
to
develop
a
similar
ransomware
in
BlackSuit.
Another
option
is
that
BlackSuit
emerged
from
a
splinter
group
within
the
original
Royal
ransomware
gang.

Whatever
the
case
may
be,
the
emergence
of
another
ransomware
like
BlackSuit
provides
further
evidence
that
threat
actors
will
always
try
to
look
for
more
effective
tools
for
their
attacks,
from
modifying
existing
code
to
developing
unique
ransomware
families,
to
profit
from
their
victims.
As
such,
both
organizations
and
individual
users
should
remain
vigilant
when
it
comes
to
protecting
their
files
and
data
from
ransomware
attacks.

Organizations
can
defend
against
ransomware
attacks
by
implementing
a
comprehensive
security
framework
that
directs
resources
towards
establishing
a
strong
defense
strategy.
Here
are
some
recommendations:

• 
  Create
  an
  inventory
  of
  assets
  and
  data
• 
  Identify
  authorized
  and
  unauthorized
  devices
  and
  software
• 
  Conduct
  audits
  of
  event
  and
  incident
  logs
• 
  Manage
  hardware
  and
  software
  configurations
• 
  Grant
  administrative
  privileges
  and
  access
  only
  when
  necessary
• 
  Monitor
  network
  ports,
  protocols,
  and
  services
• 
  Establish
  a
  whitelist
  of
  approved
  software
  applications
• 
  Implement
  measures
  for
  data
  protection,
  backup,
  and
  recovery
• 
  Enable
  multifactor
  authentication
  (MFA)
• 
  Deploy
  up-to-date
  security
  solutions
  across
  all
  system
  layers
• 
  Remain
  vigilant
  for
  early
  indications
  of
  an
  attack

By
adopting
a
multi-pronged
approach
to
securing
potential
entry
points,
such
as
endpoints,
emails,
websites,
and
networks,
organizations
can
detect
and
defend
against
malicious
elements
and
suspicious
activities,
effectively
safeguarding
themselves
from
ransomware
attacks.

A
multilayered
approach
can
help
organizations
guard
possible
entry
points
into
their
system
(endpoint,
email,
web,
and
network).
Security
solutions
can
detect
malicious
components
and
suspicious
behavior,
which
can
help
protect
enterprises. 

• 
  
  
  Trend
  Vision
  One™ provides
  multilayered
  protection
  and
  behavior
  detection,
  which
  helps
  block
  questionable
  behavior
  and
  tools
  before
  the
  ransomware
  can
  do
  any
  damage. 
• 
  
  
  Trend
  Micro
  Apex
  One™ offers
  next-level
  automated
  threat
  detection
  and
  response
  against
  advanced
  concerns
  such
  as
  fileless
  threats
  and
  ransomware,
  ensuring
  the
  protection
  of
  endpoints. 
   

Indicators
of
Compromise
(IOCs)