Ransom32: How does it work?

Question

Ransom32 seems to be a new ransomware written (partly) in JavaScript. As I understand it, it doesn't affect a user through a browser / by visiting a website, but by downloading some .rar file which contains the harmful JavaScript as well as the means to execute it.

But what exactly does Ransom32 exploit? A vulnerability in WinRAR or in Windows? Or does it rely on wrong user behavior?

The best description I could find:

The malware uses the script language implemented in WinRAR to automatically unpack the content of the archive into the user’s temporary files directory and execute the “chrome.exe” file contained in the archive.
[...]
Once Ransom32 arrives on a system and is executed [by whom? the .rar itself?], it will first unpack all its files into the temporary files folder. From there it copies itself into the “%AppData%\Chrome Browser” directory. It uses the bundled “s.exe” file to create a shortcut in the user’s Startup folder named “ChromeService” that will make sure the malware is being executed on every boot.
_source

So to me, it sounds like an attack works like this:

1. User downloads a .rar file
2. User opens the file (or does it open itself?)
3. The .rar file decides for itself where to extract to
4. The .rar file executes a .exe file (or must the user execute it?)
5. The executed file will copy/link itself to a specific location, so that it is started on every boot

Is this a correct summary?

If it is, it would seem to me as if steps 3. to 5. really shouldn't be happening[*]. Does Ransom32 exploit some known vulnerability in Windows or WinRAR? Or is this desired behavior, and did I misunderstand how the ransomware affects the system?

_{[*] I'm not that familiar with Windows security, but it doesn't seem like a good idea to let a .rar file decide for itself where it wants to be extracted to, or to let a .rar file execute .exe files.}

Answer 1

Nope, no software exploits, just classic exploitation of dumb users.

The payload is distributed in a self-extracting RAR file. A self-extracting RAR file is really just an executable extractor with the .rar file appended to the file. Such a file is an executable file with the .exe extension, and has a feature to run arbitrary code after extraction.

The steps are more like this:

1. User downloads a .exe file
2. User runs the .exe file (Fail!)
3. The .exe file extracts itself to the users Google Chrome profile to hide in
4. The .exe file run some code to make the extracted malware run and run at boot

There's really nothing original about this.

---

This post is based on the information in the following article:

http://www.bleepingcomputer.com/news/security/ransom32-is-the-first-ransomware-written-in-javascript/

Answer 2

Well, actually, Ransom32 is not an .exe file, it's a .scr (which is basically the same thing) and he doesn't use WinRAR code but NSIS code in the latest version that I've found on the web.

We can easily unpack the scr file to see interesting things :

First, the NSIS script file will launch a .NET 4.0 installer if not found on the system

Then it'll extract the "client.exe" file inside the .scr file in the %TEMP% folder and execute it. This file will create a folder in %AppData%. For each Ransom32 file generated, the folder name (and actually the stub name who is the same than the folder name) will change.

The stub connect to a server, but I can't identify it, because of the use of Tor network and the "Meek"

I hope I answer your question, and, excuse me for any language mistake please :)