Agenda Ransomware Written in Golang
Share this:
A new piece of targeted ransomware created in the Go programming language has been customized for maximum impact against individual victims.
Malware written in the Go language or Golang has become common among threat actors. Go statically compiles necessary libraries, making security analysis much harder.
Agenda ransomware, targets healthcare and education organizations in Indonesia, Saudi Arabia, South Africa and Thailand.
It offers several features, including rebooting systems in safe mode, attempting to stop many server-specific processes and services, and having multiple modes to run. The ransomware uses AES-256 for encrypting files and RSA-2048 for encrypting the generated key.
The ransomware group also offers affiliates options to customize configurable binary payloads for each victim. It evades detection by using Safe mode option for proceeding with encryption.
It takes advantage of local accounts to log on as spoofed users and execute the ransomware binary, further encrypting other machines if the logon attempt is successful. It also terminates numerous processes and services and ensures persistence by injecting a DLL into svchost.exe.
The ransom amount requested, for instance, was different for each company, ranging from $50,000 to $800,000.
Important Protection measures
- The use of multifactor authentication (MFA) solutions,
- The 3-2-1 rule when backing up important files.
- The regular patching and updating of systems.
Indicators of Compromise
- 117fc30c25b1f28cd923b530ab9f91a0a818925b0b89b8bc9a7f820a9e630464
- 93d0cc8492511c663f17544b3bf14eab8ccb492909536e79ef652921d809bb1a
- e4a319f7afafbbd710ff2dbe8d0883ef332afcb0363efd4e919ed3c3faba0342
- 28aeb2d6576b2437ecab535c0a1bf41713ee9864611965bf1d498a87cbdd2fab
