I was recently reading the Malwarebytes Labs threat analysis for Sage Ransomware. I found it interesting to learn that, apparently, in addition to system directories, which makes sense, paths to games like League of Legends as well as the path to steamapps are excluded from the attack. The article does not speculate on why this is the case, which leaves me curious and speculating to myself. Is there any readily apparent reason why the malware's creators did this? Or am I just overthinking it? Is it indicative of a target demographic, attack vector, and/ or delivery method? The only potentially obvious reason that I can think of for why this may have been done is so as not to interrupt a distracted gamer, and thus allowing the process to continue to run in the background less likely to be noticed by the user. However, I feel like that is too simple an explanation. I would venture that the average computer user would not recognize the signs of infection even if they weren't engrossed in some game or task on the system. As is intrinsically the case with the vast majority of ransomware, the target demographic is typically the casual user who is less likely to back up their data than a power user who would be more likely to notice the signs of infection, which makes this explanation seem even less likely. Considering most data for many games is not stored locally (with the majority of data that is stored locally also backed up in the cloud, as is the case with Steam) and license keys are now often managed by a digital distribution platform, I can see why it would be almost pointless to encrypt those files.* Even still, I would venture that encrypting those files would further contribute to the sense of invasion/ vulnerability/ loss experienced by the victim. From a social engineering/ psychological standpoint, this would likely increase chances of the victim paying the ransom. Am I just giving the creator(s) too much credit? A move like this seems like a very deliberate thing to do, which leaves me very curious as the motivation.

Recognizing that trying to determine or ascertain Sage coders' actual motivation for their programming decisions will more be a matter of opinion and speculation than fact, my question boils down to two questions that I encountered in speculating:

  1. What versions of windows are typically targeted? Is it similar to how WannaCry spread, targeting a wide variety of Windows OS's? Or was it more focused on home user OS's (e.g. XP, Vista, 7) versus commercial OS's (e.g. Windows Server 2000, 2008)?
  2. In what was has Sage been spread/ dropped? As the article states, "Most often, Sage is dropped by downloader scripts distributed via phishing e-mails." However, since the article states that one of the forms in which it was dropped was a standalone JavaScript file, this opens up numerous potential attack vectors. I'm curious to know if anyone is aware of any other attack vectors that Sage has used, if any at all.

*Speaking mainly about online-only games like League of Legends where the user's profile information is stored online. However, Sage excludes the entire steamapps paths, which is also where save information for local only/ single player games is stored.

UPDATE: Just to clarify, I understand why it makes logical sense to attempt to prevent from encrypting low value, easily replaceable files. However, what I find interesting is the methodology used by the coders to accomplish this. Arguably, you could generate a blacklist the specifies at least a hundred directories where low value data and files are typically stored for various use cases. However, the coders only excluded very specific file paths from encryption. Would it not makes more sense, if your goal is to encrypt as much of the highest value data as possible as quickly as possible, to try to target the encryption to file paths where the most valuable data is most typically stored? This would narrow the scope of the files being encrypted and increase the chances of catching something valuable enough to motivate a user to pay the ransom.

  • 1
    Your guess seems as good as any. There have been several ransomware attacks that specifically target gaming directories/files like TeslaCrypt, so I'm not sure of your theory. We won't know for sure, unless the coders themselves tell us.
    – Tom K.
    Jul 27 '17 at 13:58
  • True, there are attacks that have specifically targeted gaming directories. I should have been more specific. I was more referring to online only games where little to no data relevant to the user profile is actually stored on the computer itself, since League of Legends is online only and was one of the directories specifically blacklisted by the attackers. However, their methodology would also blacklist single user games (where critical save data and the like is stored locally) by excluding the entire steamapps path from encryption.
    – wjjd225
    Jul 27 '17 at 14:02
  • Or, it could be due to cultural things ? You're talking about League of legends, and with Steamapps, Counterstrike is excluded too. The guys who did this might just be big fans of e-sport, that does not want to ruin a good match with their ransomwares. Afterall, excluding these games files is not making their software less effecient right ?
    – Kaël
    Jul 27 '17 at 15:19
  • The answers so far are spot on. The games in these directories are huge files, and the more time a malware process spends the higher the chance of being detected and ended. It is unlikely that these directories would gather much ransom pay because they can just re-download the game from the digital content provider. Ransomware really wants to get ahold of your data files, not your executables and supporting files. Jul 27 '17 at 20:59
  • Most games also won't store user save files and such in in the steam folder but rather in %APPDATA% or My Documents. Jul 27 '17 at 21:11

I'm guessing these games are fairly large (GTA V is 10s of gigabytes). Therefor, it would take a considerable amount of time to encrypt these which increases the chance of being detected. Often these games store the profiles in another directory which might be included in the encryption process. The game can be reinstalled but the profile might not be recoverable.

  • I agree that it is definitely reasonable to assume they would take file size and the time it will take to encrypt larger files into consideration, and it only makes sense to assume that the coders would want to avoid wasting time encrypting easily replaceable data or data that is not likely to be valuable. However, their methodology seems almost counter intuitive. Would it not make more sense to white list directories where valuable information is most likely to be? This methodology seems more like a shot in the dark.
    – wjjd225
    Jul 27 '17 at 15:29
  • 6
    There might be an argument to be made that these files are common and replaceable, leading to a known-plaintext attack at the encryption used.
    – Delioth
    Jul 27 '17 at 17:43
  • 4
    "which increases the chance of being detected" - especially since Steam/League of Legends check on their files regularly (to prevent corruption/unwanted modifications and check for available updates) which could very likely detect the encryption in progress
    – hoffmale
    Jul 27 '17 at 20:41
  • 4
    @wjjd225 a whitelist is undesirable for ransomware. After all, many of the juicy files are stored in odd places - For example, on a server share, in a shared folder, or a random folder directly on the root drive or in the user's home folder. The only thing worse than being caught in the middle of the operation is never having performed the operation on anything important in the first place :p
    – user41341
    Jul 27 '17 at 21:28

Because it's pointless to encrypt a file that can be recovered simply by clicking on it in Steam; especially one that would busy up their encryption process.

Start with the premise that a detected attack will be interrupted, at which point no more files will be encrypted. Another way of thinking of this is that on average, ransomware will run for a finite amount of time; let's say fifteen minutes. (Some people will detect it and shut it off after less than a minute, others will let it run for hours to completion.) Furthermore, assume that an attack takes time to encrypt a file; perhaps one second per image file on average.

The attackers make their money only if the pain they inflict is so great that the victim is willing to negotiate with them. How do we measure this pain? If what they encrypted was of most value to the victim. Let's say someone has 1000 image files on their disk, 10 of which are irreplaceable photos of a deceased loved one that have great sentimental value. If the encryptor hits all 10, the victim will definitely pay to recover them. If the encryptor hits only one of them, the victim will be upset, but probably won't pay. If the encryptor hits 5 of the 10, the victim might pay, or might not. We could express this as percentage: 1 file is a 10% chance they'll pay, 10 files is a 100% chance.*

The encryptor goes through the file system and enumerates the various image and document files, but it doesn't know which are the 10 important ones the victim cares about. For the purposes of the attack, all image files are equal, so anything that improves the chances of encrypting all 10 sentimental files improves the chances he'll get paid the ransom. With a fifteen minute window, about 900 files will be encrypted.

Games may have image and movie files containing artwork, cut-scenes, and other stuff. Let's say the victim has a game with 1000 image files in it. But game files are easily replaceable - click "install" in Steam, and they're back. Nobody will pay the ransom for those files.

So by excluding the game files, the attacker has a 90% chance of getting paid. If he doesn't exclude the game files, the attacker has a 45% chance of getting paid.

It's just math.

* I know that not everyone is an absolute 10% or 100% or whatever; the idea is that there a certain percentage of victims who will be more likely to pay, and that is reflected in the final analysis. It's certainly not an exact 90% or 45%, just that some people will be far more incentivized to pay than others.

  • 1
    I definitely agree with you in terms of the math. What you're saying is very similar to what Silver said. I do think that you're giving the victims too much credit. What I have seen professionally in the wild so far, with respect to the recent ransomware "outbreaks," is that very few users do notice that they have been infected and respond quickly enough to prevent further encryption. I do have a firm understanding of both how and why ransomware works, both from formal education and professional experience. I am, however, not a malware analyst.
    – wjjd225
    Jul 27 '17 at 17:11
  • 1
    More so, from what I have seen, the ransomware creators don't typically have a specific target or demographic in mind when they launch their attack. Oftentimes, they don't even know who or what they have managed to infect and encrypt, which is why we have reports of large organizations getting infected and only being asked to pay a ransom of $1,000 (USD). This attack seems different in that it almost seems like its expecting to find certain things on the infected victim's systems. As I said before, it seems like a shot in the dark as far as attempting to limit the scope of their encryption.
    – wjjd225
    Jul 27 '17 at 17:16
  • 1
    I don't think you need to be a malware analyst. These reflect the "business requirements" of the attacker, not the technical requirements. Jul 27 '17 at 17:16
  • 6
    Also, it doesn't matter if it's a corporate desktop, a gamer's beast, or mom's PC. There's no value in encrypting easily recoverable files, regardless of the nature of the system. Steam files are easy to identify and certainly qualify as "easily recoverable". Jul 27 '17 at 17:20
  • Agreed. I just updated my post to say essentially this, but my point is that, the attackers methodology isn't really even slightly effective for achieving the goal of excluding the low value files and targeting the high value files. It seems to be geared towards one very specific use case, which seems to me to be counter intuitive. Maybe I'm just giving the attackers too much credit.
    – wjjd225
    Jul 27 '17 at 17:32

These two systems both perform file validation. If your program stops working, as a user, you will try to fix it by running the file repair.

Later, you find that your system is encrypted with ransomware. You pay the fine, they give you the decryption key, you run the decryption software...

Ten minutes later, you're on their support channel in IRC. "It's failing with the error message 'Checksum error with file C:\Steam\User\DewiMorgan\PlantsVsZombies\data.dat, decryption failed. How do I fix it?'

As a service provider, you want to minimize decryption errors, and minimize support issues. So you avoid encrypting those folders which cause the most support issues.

In general, encryption is low-cost. An attacker should encrypt by default: a whitelist won't always catch the folders that the most valuable data is stored in. You don't even know what any individual user considers valuable.

But there are some folders which are definitively:

  • High risk of being overwritten after encryption, resulting in decryption errors.
  • High time-to-encrypt, risking being caught before you've got to the Good Stuff.
  • Zero effort to replace if lost, so non-valuable: encryption is wasteful.

So while a whitelist would damage your attack's genericism, a blacklist has value because it defends against specific problems.

Not the answer you're looking for? Browse other questions tagged or ask your own question.