One campaign sent messages claiming to be from Germany’s Bundeszentralamt fur Steuern (Ministry of Finance), while another posed as a tax message from Italy’s Agencia Entrate (Internal Revenue Service).The Italian version of the attack claimed to be instructions to avoid being designated as tax cheats, with further details in the attached file VERDI.doc—described as an “interactive tool”, a ploy to trick the user to enable Visual Basic for Applications (VBA) macros. The voice message is created using the Microsoft Speech API with the default voice and default audio. It tries to find out the role of that the current machine in the network, in order to reuse it in the extortion—Maze varies the amount of the ransom depending on whether the target is a home computer, or a workstation or server on a corporate network.This information is exfiltrated back to the command and control server using a standard port 80 HTTP POST method, connecting using Windows’ socket library, WS2_32.dll. Etre au courant des menaces est le premier pas vers la cybersécurité.Start a Sophos demo in less than a minute. Dear *User*, Your files have been encrypted…”Both the wallpaper and the voice message are stored in text forms within the binary. Start a 30 day free trial of Sophos Intercept X Endpoint in less than 2 minutes. And they claim to be ready to cut a deal for those hurt by the COVID-19 induced global economic downturn.In the past, the Maze group has withdrawn data posted to its site due to extenuating circumstances, such as when the group backed off blackmail demands against the City of Pensacola following the shooting of two members of the US Navy at the naval air station there.
As with some other ransomware, Maze will terminate without encrypting files if certain languages are detected (such as those used in Commonwealth of Independent States nations).Information about the local network its target is connected is also gathered by the malware, by creating a null session connection and enumerating network resources. Previously identified as “ChaCha ransomware” (a name taken from stream cipher used by the malware to encrypt files), the Maze “brand” was first affixed to the ransomware in May, 2019.Initial samples of Maze were tied to fake websites loaded with exploit kits. Many of these are there just to grab the attention of researchers, either to send some message or (as mentioned earlier) to name researchers that they know have been examining their code.There are also some samples that can be run with more meaningful, functional switches, such as:Aside from the obfuscation, the Maze main binary’s authors applied a number of anti-analysis techniques to the malware.
(The page has recently been updated with information about alleged victim Banco BCR. And in March, the Maze team announced that it would stop attacks on medical organizations until the COVID-19 pandemic “stabilizes.”In the most recent “press release” (dated April 17, 2020), the operators of Maze wrote:We are living in the same reality as you are. And it uses a mutex to ensure that another instance of Maze doesn’t execute (unless it’s a sample that has been executed with the –nomutex switch).As with most ransomware, it deletes shadow copies with the Windows Management Instrumentation command line utility WMIC.exe. On one board, the Maze team uses the account name “Kremez”, after prominent ransomware researcher Vitali Kremez, to post links to dumps of data from companies that failed to pay.But the main platform used to promote the Maze brand is the Maze team’s websites—one specifically for its victims, and another to communicate with the world at large (and encourage victims publicly to pay up).The web panel for victims features the ring’s ironic slogan, “Victims arriving at the site after following the URL in the ransom note are asked to provide the file DECRYPT-FILES.txt dropped by the ransomware, which contains the identification number assigned to the victim.Once they’ve identified themselves, victims can upload three files for decryption as proof that the Maze crew can truly restore their data. The criminals behind Maze ransomware began incorporating this tactic of steal and share as additional extortion pressure in their ransomware operations. The Maze gang has made public exposure central to their “brand” identity, and actively seeks attention from press and researchers to promote their brand—and make it easy for victims who might hesitate to pay them to find out their reputation.Maze rose to greater attention in October of 2019, when the ransomware’s operators launched a massive spam campaign that masqueraded as messages from government agencies. REvil/Sodinokibi began releasing data at about the same time as Maze; the DoppelPaymer and Clop ransomware rings have followed suit, and Maze’s operators seek attention in many ways, in an effort to spread their reputation—and increase the likelihood that their “clients” (as they call their victims) pay quickly. See exactly how our solutions work in a full environment without a commitment.Un seul endroit pour tous les produits en évaluation. While threatening to expose victims’ data has long been part of ransomware operators’ playbook, Maze was among the first to follow through on such a threat in a public fashion—starting with the Maze is not alone in adopting this tactic. The background text is converted to bmp with the use of the DrawTextW and GetDIBits APIs, and is dropped as 000.bmp and set to the wallpaper. One campaign sent messages claiming to be from Germany’s Bundeszentralamt fur Steuern (Ministry of Finance), while another posed as a tax message from Italy’s Agencia Entrate (Internal Revenue Service). “With Sophos we’ve had zero ransomware infections” Name recognition is important to them, even as they remain anonymous. When macros were enabled, the scripts within the document downloaded the Maze ransomware to %TEMP% folder, and then executed it.Since then, Maze ransomware has gained notice largely from stealing and publishing victims’ data as a means to coerce payment. The URI path is created from a hard-coded string list to building up the URI path.The malware sends information including the username, drive information, drive free space, language, antivirus product present, and OS version back to the server.Maze uses RSA and ChaCha20 stream cipher encryption to lock victims’ files.