CYBERVOLKRANSOMWARETECHNICAL &MALWAREANALYSIS

THREATMON.IO

TABLE OFCONTENTS
Attack Chain

3

Diamond Model

4

Executive Summary & Key Findings

5

About CyberVolk Group

6

About Cybervolk Ransomware

8

What Sets CyberVolk Ransomware Apart fromthe Others?

10

CyberVolk Ransomware Contributors

11

A Quick Look into the CyberVolk Ransomware

12

Technical Malware Analysis

13

Basic Characteristics of CyberVolk Ransomware

13

Dynamic Analysis of CyberVolk Ransomware

15

CyberVolk Ransomware Static Analysis

18

CyberVolk Ransomware Vulnerabilities

21

Mitigations

23

Categorizations

24

Mitre Att&ck Table

24

Yara Rule25

IOC List

26

Sigma Rules

26

3

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSISATTACK CHAIN

Cyber Volk

Phishing

User

Ransomware

tmp.bmp

time.dat.CyberVolk

CyberVolk_
ReadMe.txt

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSISDIAMOND MODEL

4

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Executive Summary & Key Findings
As ThreatMon, we strive to prevent potential malicious activities by informing
individuals, companies, firms, institutions, and organizations about current threats
through our reports, posts, and analyses.
CyberVolk Group is a threat actor group originating from India and is one of themembers of the Holy League organization, established by APT 44 and otherRussian/Russian-aligned hackers to carry out attacks against NATO, Ukraine, andstates opposing Russia. Such formations pose a global threat.
CyberVolk Ransomware was developed by the CyberVolk Financially MotivatedThreat Actor Group and released for sale as Ransomware-as-a-Service (RaaS) on
July 1, 2024. After the initial version of the ransomware was leaked on VirusTotal,
the CyberVolk group developed a new version and continued their RaaS services
with this new version on July 10, 2024.
Operates in an offline structure, encrypts files with the .CyberVolk extension anddemands a payment of $1,000 for the decryption key.
The ransomware employs ChaCha20-Poly1305, AES, RSA, and quantum-resistantalgorithms for encryption, making it highly secure. If an incorrect decryption key isprovided, instead of indicating that the key is wrong, it initiates the decryption
process, and at the end, it writes 0-byte data into the encrypted files, leading tosevere data loss.
CyberVolk ransomware has been found to block TaskManager in order to preventthe encryption process from terminating. By opening the task manager, the user
cannot terminate the running ransomware through the task manager. However, as
ThreatMon Malware team, we have identified critical vulnerabilities in CyberVolk
ransomware that affect the encryption process and summarized them in detail.
The ransomware developed by the CyberVolk group is a current threat to all
windows users (individuals, companies, institutions, organizations, etc.).
Especially according to the intelligence information collected, the +20.000$ thatthe cybervolk group admin claims to have earned through this ransomware
demonstrates the seriousness of this threat level.
You can find more information and a technical analysis of the CyberVolk
ransomware in the continuation of the report.

5

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

About Cybervolk Group

Image of Cybervolk Group Twitter AccountCybervolk Hacker Group is an Indian cyber crime organization that was
founded on March 28 2024 under the name GLORIAMIST India and laterchanged to Cybervolk.

Image of Cybervolk Group Twitter AccountIt was ﬁrst identiﬁed by ThreatMon after their partnership with
Noname057(16).
Russian-based hacker groups (Noname057(16) and the cyber arm of russia)
have been attracting newly founded cybercrime organizations that can dosuccessful work, and Cybervolk is one of these groups.

6

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Image of Cybervolk Group Activities

According to the intelligence obtained by ThreatMon, the Cybervolk grouphas so far been involved in DDoS attacks, Website Defacement attacks, Data
Leak attacks, Network Breach attacks and Ransomware attacks.

Image of Holy League Organization

At the same time, the Cybervolk group has been identified as one of the 45
hacker groups of the Holy League organization, which was recently createdby Russian threat actors to attack NATO, Ukraine and Israel.

7

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

About Cybervolk Ransomware

Image of CyberVolk Group Telegram Post

CyberVolk Ransomware was ﬁrst completed on July 1, 2024, and it was detected
being marketed as RaaS (Ransomware as a Service) on the dark web and Telegramon July 3, 2024. The initial ransomware was developed in the C++ language and,like most ransomware, uses the AES encryption algorithm. The SHA512 hashalgorithm is used for AES key generation.

Image of CyberVolk Ransomware VirusTotal Leak

However, the initial ransomware(with the .cvenc extension) was leaked on
VirusTotal and rendered non-functional. Consequently, CyberVolk subjected theransomware to a significant update, making many changes within the ransomware.

8

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Image of CyberVolk Ransomware Telegram Post

According to the CyberVolk Group's post on Telegram, on July 23 2024,
significant updates occurred in the ransomware after the leak on VirusTotal.
The .cvenc extension has been replaced by the .CyberVolk extension.
The AES encryption algorithm has been replaced by ChaCha20-Poly1305 + AES +RSA + Quantum resistant algorithms.
It is claimed to be FUD (Fully UnDetectable).
It can encrypt and decrypt without the need for a C2 (Command and Control) server(offline ransomware).
If the wrong key is entered, the contents of the encrypted files are deleted,
and if there is no backup of the data, it is lost forever.

9

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

What Sets CyberVolk Ransomware Apart from the Others?
In general, PQC/Quantum-resistant algorithms are not commonly used byransomware. These algorithms are employed to be secure against cryptanalytic
attacks by quantum computers. This is the first time a quantum-resistant algorithm
has been observed being used within ransomware.

Image of CyberVolk Admin Leaked Telegram Chat

According to the intelligence obtained, it has been determined that the Cybervolk
admin made a proﬁt of $2632 from the ransomware in the past.
However, it is now claimed that this proﬁt has exceeded over $20,000. Thissituation highlights the high-level threat posed by CyberVolk ransomwarein the black-market(Screenshot not shared knowingly).

10

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

CyberVolk Ransomware Contributors

Image of CyberVolk Ransomware Contributors

The threat actor known by the alias Hacker-K is known to be of Indian origin and is
the leader of the CyberVolk group.

Image of Ghost Door Leaked Telegram Chat

The threat actor known by the alias ghostdoor_maldev is of china origin and is notdirectly associated with any group. This actor finds threat actor groups and makes
requests for malware development to them. It has been identified as a threat actor
in the expert class, particularly in the areas of cryptography and ransomware.

11

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

A Quick Look into the CyberVolk Ransomware
After the successful unpacking of AzzaSec Ransomware, its basic characteristics
have changed as follows:

Image of CyberVolk Ransomware

After running on the system, CyberVolk ransomware directly displays the payment
screen and begins encrypting all files by restricting user activities within thesystem. It prevents applications like Task Manager from opening to ensure theencryption process is not interrupted, and it encrypts all files in a short time.
The ransomware gives the user a 5-hour window to make the payment.
Additionally, it creates a Readme.txt file within the system.

Image of CyberVolk Ransomware Readme.txt

In the Readme.txt, it is observed that a payment of $1,000 is demanded within this5-hour.
If the $1,000 payment is not made, data loss occurs within the infected
system.

12

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Technical Malware Analysis
Basic Characteristics of CyberVolk Ransomware

Image of CyberVolk Ransomware Characteristics

When examining the ﬁle features of the CyberVolk Ransomware, it is observed that
it is developed in C++, has a size of 7.79MB, and does not use any packer.

FileType

Portable Executable 32

LanguageC++

FileSize

7.79 MB | 8167424 bytes

PeSize7.79 MB | 8167424 bytes

PackerNot Packed

MD5

4E66429D85967E344D8354E9B81719DC

SHA1

B958FB7241CC9675B8DD967B02DF6A6AD92DE52D

Sha256

de0b74917fe24c2b38e2d1172b7352f88bf8b3df64b6d44ca5f317db85aeb324

IMPHash0982e392aba6a868dc7bda8b61e977ab

13

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Dynamic Analysis of CyberVolk Ransomware

Image of CyberVolk Ransomware Dynamic Analysis I

It is observed that CyberVolk ransomware starts its process by writing a
BMP ﬁle to the $HOME\\AppData\\\Temp directory. The BMP ﬁle is then set
as the background image.

Image of CyberVolk Ransomware Dynamic Analysis II

Then it prints the "time.dat" file to the system and starts the GUI. A time of 5hours is specified in "time.dat" and a timer is set on the GUI according to thedata written there.

14

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Image of CyberVolk Ransomware Dynamic Analysis III

After creating the time.dat ﬁle, it starts encryption from the ﬁrst directory of
the $HOME directory. Firstly, it creates a ﬁle with .CyberVolk extension andthen encrypts it by reading the contents of the ﬁle, then writes theencrypted data into the ﬁle with .CyberVolk extension. Then it deletes the
unencrypted ﬁle from the system.

Image of CyberVolk Ransomware Dynamic Analysis IV

15

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

According to the CyberVolk Group's post on Telegram, on July 23 2024,
significant updates occurred in the ransomware after the leak on VirusTotal.
“Greetings.
All your files have been encrypted by CyberVolk ransomware.
Please never try to recover your files without decryption key which I give you after pay.
They could be disappeared?
You should follow my words.
Pay $1000 BTC to below address.
My telegram : @hacker7
Our Team : https://t.me/cubervolk
We always welcome you and your payment.”

Image of CyberVolk Ransomware Dynamic Analysis V

When the process operations are monitored in the dynamic analysis, it isobserved that the console "conhost.exe" for GUI support is started
depending on the main process. No additional potentially harmful process,network connection, persistence or any other methods/techniques weredetected.
During the observation process, the "SafeBoot" key draws attention.
CyberVolk ransomware is observed to be tampering with the safe modesettings of the windows device. It is also observed that it reads dec_key.dat
in the $HOME\\AppData\\\Roaming directory. The file is not createdbecause it does not write.

16

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Image of CyberVolk Ransomware Dynamic Analysis VI

During the decryption process, the situation of checking with theoriginal key was examined in detail, but no such comparison was found.
CyberVolk ransomware does not compare the provided decryption key
with the original decryption key.
Instead, after acquiring the key from the dec_key.dat file, it uses theWriteFile API to create an empty file with the actual name of the.CyberVolk extension file. For example, for the file file.txt.CyberVolk, itwrites an empty file named file.txt on the disk. Then, using the
NtWriteFile API, it processes the decryption key and writes thedecrypted content of the encrypted file into file.txt. However, during
this process, the buffer memory is not checked. If the provided key isincorrect, instead of writing corrupted data into the file, it writes 0-byte
data. But if the provided key is correct, since the generated data won't
be corrupted, it writes the decrypted file content correctly.

Image of CyberVolk Ransomware Dynamic Analysis VII

CyberVolk Ransomware detects whether it is running in safe modeusing GetOSSafeBootMode and the SafeBoot registry key. The
HideInSafeMode function is used to hide or stop certain functions
when safe mode is detected.

17

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

CyberVolk Ransomware Static Analysis

Image of CyberVolk Ransomware Static Analysis II

The function, for the string "Decryption Key is Not Correct" was analyzed
due to its potential relation to the encryption key. It was found that it does
not check the actual encryption key. Instead, it calculates a 36-character
value. If the entered value is not exactly 36 characters, it shows the"Decryption Key is Not Correct" message and returns 0. However, if thestring is 36 characters, it proceeds with the decryption process without
validating the actual encryption key.

Image of CyberVolk Ransomware Static Analysis III

When it detects a 36-digit value, it is observed that it starts the decryption
process. At the same time, a write operation is performed in the _fopen code
structure. Here, the 36 byte of value received as input from the user isprinted on dec_key.dat, which was displayed within the dynamic analysis.

18

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Image of CyberVolk Ransomware Static Analysis IV

It is observed that CyberVolk Ransomware can detect debuggers with the"IsDebuggerPresent" API. If the debugger is detected, the function is
terminated, but if the debugger is not detected, the program continues withthe resetGlobalVariable() function.

Image of CyberVolk Ransomware Static Analysis V"IsProcessorFeaturePresent" API determines whether the speciﬁc
processor feature is supported by the computing environment in which it isrunning.
It is also observed that the Ransomware accesses information related to theCPU. the CPUID instruction is utilized to distinguish between virtual andphysical environments. CPUID queries the processor's attributes and checks
virtualization indicators to determine if the environment is a virtual machine.

19

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Image of CyberVolk Ransomware Static Analysis VI

CyberVolk Ransomware has been found to include activity similar to a worm
virus. It scans all drive letters between "a" and "z". If these drives are of thetype where it can spread itself (removable, hard, network), it creates a multithread to execute on these drives. This structure has an auto spread feature
like a worm.

Image of CyberVolk Ransomware Static Analysis VII

CyberVolk ransomware continuously searches for the window named"TaskManagerWindow" via the "FindWindowA" API by waiting for 1 secondin an inﬁnite loop running as a different thread. When it ﬁnds it, it sends
0x0010 (WM_CLOSE) via the PostMessageW API to close the window. This
prevents the user from terminating the cybervolk ransomware process via
the task manager.

20

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Image of CyberVolk Ransomware Static Analysis VIII

When the decryption process is completed, the program terminates itself
using the _exit(1); function. However, since it does not involve any
persistence, writing itself to a process, or utilizing any othertechnique/method, it does nothing else in the self-cleaning stage other thanterminating itself.

CyberVolk Ransomware Vulnerabilities
ThreatMon Malware Team has identiﬁed several vulnerabilities in the
CyberVolk ransomware that have a critical impact on its infection process.

Image of CyberVolk Ransomware Vulnerabilities I

Unlike most ransomware, CyberVolk ransomware first launches the GUI andthen starts encrypting the system with multithreats. In this time, it was foundthat the task manager was blocked to prevent the process from being
interrupted, but powershell was not blocked.

21

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Image of CyberVolk Ransomware Vulnerabilities II

As soon as the GUI is launched and the necessary commands are given in
PowerShell to terminate the process, the encryption process is interrupted.
Additionally, since it does not contain any persistence features within its structure,
the Cybervolk ransomware does not reactivate or attempt to re-encrypt ﬁles if thedevice is restarted.
Command

Get-Process

Command

Stop-Process -Name <CyberVolk_Ransomare.exe>

Image of CyberVolk Ransomware Vulnerabilities III

Additionally, the CyberVolk ransomware operates by continuously counting downfrom 18,000 seconds, as written in the time.dat ﬁle. The timer can be manually
adjusted by modifying the time.dat ﬁle, which allows the countdown to be extended
indeﬁnitely. This capability can facilitate the work of reverse engineering, forensic,
and malware analysis teams by providing more time for analysis.

22

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSISMITIGATION
Ensure that data is backed up regularly, and keep multiple copies,
including one offline or in a cloud service.
Educate employees on recognizing phishing emails, suspicious links,
and social engineering tactics.
Keep all systems, software, and firmware up-to-date with the latest
security patches.
Deploy and regularly update security software across all endpoints.
Use CTI to set up early warning alerts for ransomware campaigns thatare targeting your industry or region. These alerts can help yourorganization prepare for potential attacks before they reach you.
Use advanced spam filtering to reduce the risk of phishing emails
reaching end users.
Enforce the principle of least privilege (PoLP) to limit user access to
only what is necessary for their role.
Subscribe to threat intelligence feeds that provide information on
emerging ransomware threats.
Implement application whitelisting to allow only approved programs to
run on your systems, preventing unauthorized or malicious softwarefrom executing.

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

23

24

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Categorization
APT Group

It is not an APT group, but it has affiliations with APT 44

Threat Category

Ransomware

Malware Family

GandCrab Ransomware

Mitre Att&ck Table
Tactics

Technique ID

Technique Name

InitialAccess

T1566

Phishing

Execution

T1106
T1204.002

Native API
User Execution: Malicious File

DefenseEvasionT1562.001
T1562.009

Impair Defenses: Disable or Modify Tools
Impair Defenses: Safe Mode Boot

Discovery

T1010
T1622
T1083
T1012
T1124
T1497

Application Window Discovery
Debugger Evasion
File and Directory Discovery
Query Registry
System Time Discovery
Virtualization / Sandbox Evasion

Impact

T1486
T1485
T1565

Data Encrypted For Impact
Data Destruction
Data ManipulationCYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSISCYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

Yara Rule
Download the Yara Rule From ThreatMon Github Page.
rule CyberVolk_Ransomware_Yara{
meta:
description = "Yara rule for detecting CyberVolk Ransomware"author = "Aziz Kaplan"
email = "aziz.kaplan@threatmonit.io"
file_hash = "d08243e976e01baa5479a134577a1407daf4bec89a5f47bf2b803c0919917f5b"
strings:$OP1 = {8d 84 24 b0 04 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6a 00}$OP2 = {8b 7d 08 6a 24 68 5c 90 42 00}//8b7d086a24|MOVEDI,dwordptr[EBP+arg]//685c904200|PUSH<start_of_encryption>$OP3 = {6a 24 68 5c 90 42 00}//6a24|PUSH0x24//685c904200|PUSH<start_of_decryption>$OP4 = {8d 51 01 ?? ?? ?? ?? ?? ?? ?? 2b ca 83 f9 24 74 1b}//Check of “if” condition of decryption process//8d5101|LEAEDX,[ECX+0x1]//2bca|SUBECX,EDX//83f924741b|CMPECX,0x24$OP5 = {ff 15 d0 31 42 00}//Call of API after the if condition//ff15d0314200|dwordptr[->USER32.DLL::MessageBoxA]$OP6 = {8d 4c 24 30 e8 2b 02 00}//Character replacment after the decryption key is provided//8d4c2430|LEAECX,[ESP+0x30]//e82b0200|character_replacement$OP7 = {8d 84 24 20 01 00 00 ?? ?? ?? ?? ?? ?? e8 c7 9c fe ff}$OP8 = {8d 44 24 38 ?? ?? ?? e8 23 a2 fe ff}//File Creation dec_key.dat//8d842420010000|LEAEAX,[ESP+0x120]//e8c79cfeff|CALL_fopen//8d442438|LEAEAX,[ESP+0x38]//e823a2feff|file_operation$OP9 = {68 80 0d 00 00 ff 75 08 ff 15 e8 31 42 00}//Timer Killer//68800d0000|PUSH0xd80//ff7508|PUSHdwordptr[EBP+param_1]//ff15e8314200|CALLdwordptr[->USER32.DLL::KillTimer]$OP10 = {83 f8 0f ?? ?? 3d 10 01 00 00}//Conditions for decryption process//83f80f7468|CMPEAX,0xf//3D10010000|CMPEAX,0x110$OP11 = {84 c0 74 10 ff 75 08 ff 15 08 31 42 00 ?? ff 15 0c 31 42 00}//Terminating itself if a condition is met$OP12 = { 54 61 73 6b 4d 61 6e 61 67 65 72 57 69 6e 64 6f 77 00 00 00 }//TaskManagerWindow$OP13 = { 25 73 5c 74 69 6d 65 2e 64 61 74 00 }//time.dat$OP14 = { 25 73 5c 64 65 63 5f 6b 65 79 2e 64 61 74 00 }//dec_key.dat
condition:
uint32(uint32(0x3C)) == 0x00004550 or(filesize > 4 and uint32(0) == 0x464C457F) or(uint32(0) == 0xCEFAEDFE or uint32(0) == 0xCFFAEDFE) and(11 of ($OP*))}

25

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

IOC List

Sha256

de0b74917fe24c2b38e2d1172b7352f88bf8b3df64b6d44ca5f317db85aeb
324
70257c48ed8e1a3b57a7d6a5bed17837f60d630bdda0b22b048a3721569f
e038
7d294c60c44b8b776c45e46e904a2de70ff4820e7e7863adb9f191c6554f
9fb5
74b5a0ed14c7b8e26d51d4b9242e73686bad2e63cd11d9cbdb52e08fa341
58c1

Sigma Rules
Download the Sigma Rules From ThreatMon Github Page.
title: Suspicious File Creation Detected
id: 8a5a94e2-5a2e-4b1a-bb97-03c7d5cf9a93
status: experimental description: |Checks for BMP and DAT file creation within specific directories.
author: Aziz Kaplan <aziz.kaplan@threatmonit.io>
logsource:
category: file_accessproduct: windows
detection:
selection:
FileName|contains:- '\AppData\Local\'- '\AppData\Roaming\'- '\AppData\Local\Temp\'
FileName|endswith:- '.bmp'- '.datfilter_system_folders:
Image|startswith:- 'C:\Program Files\' 'C:\Windows\' - 'C:\ProgramFiles(x86)\''C:\Windows\system32\''C:\Windows\SysWOW64\'
condition: selection and not 1 of filter_system_folders
falsepositives:- Legitimate software installed that creates BMP file in Temp directory
level: medium

26

CYBERVOLK RANSOMWARE TECHNICAL & MALWARE ANALYSIS

title: .CyberVolk Extension Detected
id: 37b2c73a-f147-4d93-842e-0b853b55de49
status: stable
description: Detects changes in file extensions where files are renamed to use
the .CyberVolk extension, typical in ransomware activity.
author: Aziz Kaplan <aziz.kaplan@threatmonit.io>
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: '.CyberVolk'
condition: selection
falsepositives:- Unlikely
level: criticaltitle: CyberVolk Ransomware ImpHash Detected
id: e45cf64a-8af9-4e69-9b55-278f44f2b1d1
status: test
description: Detects CyberVolk Ransomware from import hash (imphash)author: Aziz Kaplan <aziz.kaplan@threatmonit.io>
logsource:
category: process_creation
product: windows
detection:
selection:- Imphash:- 0982e392aba6a868dc7bda8b61e977ab # CyberVolk- Hashes|contains:- IMPHASH=0982e392aba6a868dc7bda8b61e977ab
condition: selection
falsepositives:- Legitimate use
level: high27More Information About ThreatMon

One Platform for all intelligence needs.
ThreatMon End-to-end intelligence is a cutting-edge, cloud-based SaaS platformthat continuously monitors the dark and surface web, providing early warnings
and actionable insights into emerging threats.
We are a SaaS platform designed to help businesses proactively detect andaddress threats before a cyber attack occurs. Unlike traditional cyber threat
intelligence, we provide comprehensive and holistic cyber intelligence.
• Attack Surface Intelligence• Fraud Intelligence• Dark and Surface Web Intelligence
APPLY• Threat Intelligence

FREE ACCESS
Contact Us:
Email Address
team@threatmonit.io

https://x.com/MonThreat
https://www.linkedin.com/company/threatmon