Why does Sage Ransomeware blacklist League of Legends, steamapps, etc.? [closed]

Question

I was recently reading the Malwarebytes Labs threat analysis for Sage Ransomware. I found it interesting to learn that, apparently, in addition to system directories, which makes sense, paths to games like League of Legends as well as the path to steamapps are excluded from the attack. The article does not speculate on why this is the case, which leaves me curious and speculating to myself. Is there any readily apparent reason why the malware's creators did this? Or am I just overthinking it? Is it indicative of a target demographic, attack vector, and/ or delivery method? The only potentially obvious reason that I can think of for why this may have been done is so as not to interrupt a distracted gamer, and thus allowing the process to continue to run in the background less likely to be noticed by the user. However, I feel like that is too simple an explanation. I would venture that the average computer user would not recognize the signs of infection even if they weren't engrossed in some game or task on the system. As is intrinsically the case with the vast majority of ransomware, the target demographic is typically the casual user who is less likely to back up their data than a power user who would be more likely to notice the signs of infection, which makes this explanation seem even less likely. Considering most data for many games is not stored locally (with the majority of data that is stored locally also backed up in the cloud, as is the case with Steam) and license keys are now often managed by a digital distribution platform, I can see why it would be almost pointless to encrypt those files.* Even still, I would venture that encrypting those files would further contribute to the sense of invasion/ vulnerability/ loss experienced by the victim. From a social engineering/ psychological standpoint, this would likely increase chances of the victim paying the ransom. Am I just giving the creator(s) too much credit? A move like this seems like a very deliberate thing to do, which leaves me very curious as the motivation.

Recognizing that trying to determine or ascertain Sage coders' actual motivation for their programming decisions will more be a matter of opinion and speculation than fact, my question boils down to two questions that I encountered in speculating:

1. What versions of windows are typically targeted? Is it similar to how WannaCry spread, targeting a wide variety of Windows OS's? Or was it more focused on home user OS's (e.g. XP, Vista, 7) versus commercial OS's (e.g. Windows Server 2000, 2008)?
2. In what was has Sage been spread/ dropped? As the article states, "Most often, Sage is dropped by downloader scripts distributed via phishing e-mails." However, since the article states that one of the forms in which it was dropped was a standalone JavaScript file, this opens up numerous potential attack vectors. I'm curious to know if anyone is aware of any other attack vectors that Sage has used, if any at all.

*Speaking mainly about online-only games like League of Legends where the user's profile information is stored online. However, Sage excludes the entire steamapps paths, which is also where save information for local only/ single player games is stored.

UPDATE: Just to clarify, I understand why it makes logical sense to attempt to prevent from encrypting low value, easily replaceable files. However, what I find interesting is the methodology used by the coders to accomplish this. Arguably, you could generate a blacklist the specifies at least a hundred directories where low value data and files are typically stored for various use cases. However, the coders only excluded very specific file paths from encryption. Would it not makes more sense, if your goal is to encrypt as much of the highest value data as possible as quickly as possible, to try to target the encryption to file paths where the most valuable data is most typically stored? This would narrow the scope of the files being encrypted and increase the chances of catching something valuable enough to motivate a user to pay the ransom.

Answer 1

I'm guessing these games are fairly large (GTA V is 10s of gigabytes). Therefor, it would take a considerable amount of time to encrypt these which increases the chance of being detected. Often these games store the profiles in another directory which might be included in the encryption process. The game can be reinstalled but the profile might not be recoverable.

Answer 2

Because it's pointless to encrypt a file that can be recovered simply by clicking on it in Steam; especially one that would busy up their encryption process.

Start with the premise that a detected attack will be interrupted, at which point no more files will be encrypted. Another way of thinking of this is that on average, ransomware will run for a finite amount of time; let's say fifteen minutes. (Some people will detect it and shut it off after less than a minute, others will let it run for hours to completion.) Furthermore, assume that an attack takes time to encrypt a file; perhaps one second per image file on average.

The attackers make their money only if the pain they inflict is so great that the victim is willing to negotiate with them. How do we measure this pain? If what they encrypted was of most value to the victim. Let's say someone has 1000 image files on their disk, 10 of which are irreplaceable photos of a deceased loved one that have great sentimental value. If the encryptor hits all 10, the victim will definitely pay to recover them. If the encryptor hits only one of them, the victim will be upset, but probably won't pay. If the encryptor hits 5 of the 10, the victim might pay, or might not. We could express this as percentage: 1 file is a 10% chance they'll pay, 10 files is a 100% chance.*

The encryptor goes through the file system and enumerates the various image and document files, but it doesn't know which are the 10 important ones the victim cares about. For the purposes of the attack, all image files are equal, so anything that improves the chances of encrypting all 10 sentimental files improves the chances he'll get paid the ransom. With a fifteen minute window, about 900 files will be encrypted.

Games may have image and movie files containing artwork, cut-scenes, and other stuff. Let's say the victim has a game with 1000 image files in it. But game files are easily replaceable - click "install" in Steam, and they're back. Nobody will pay the ransom for those files.

So by excluding the game files, the attacker has a 90% chance of getting paid. If he doesn't exclude the game files, the attacker has a 45% chance of getting paid.

It's just math.

* I know that not everyone is an absolute 10% or 100% or whatever; the idea is that there a certain percentage of victims who will be more likely to pay, and that is reflected in the final analysis. It's certainly not an exact 90% or 45%, just that some people will be far more incentivized to pay than others.

Answer 3

These two systems both perform file validation. If your program stops working, as a user, you will try to fix it by running the file repair.

Later, you find that your system is encrypted with ransomware. You pay the fine, they give you the decryption key, you run the decryption software...

Ten minutes later, you're on their support channel in IRC. "It's failing with the error message 'Checksum error with file C:\Steam\User\DewiMorgan\PlantsVsZombies\data.dat, decryption failed. How do I fix it?'

As a service provider, you want to minimize decryption errors, and minimize support issues. So you avoid encrypting those folders which cause the most support issues.

In general, encryption is low-cost. An attacker should encrypt by default: a whitelist won't always catch the folders that the most valuable data is stored in. You don't even know what any individual user considers valuable.

But there are some folders which are definitively:

• High risk of being overwritten after encryption, resulting in decryption errors.
• High time-to-encrypt, risking being caught before you've got to the Good Stuff.
• Zero effort to replace if lost, so non-valuable: encryption is wasteful.

So while a whitelist would damage your attack's genericism, a blacklist has value because it defends against specific problems.