I was recently reading the Malwarebytes Labs threat analysis for Sage Ransomware. I found it interesting to learn that, apparently, in addition to system directories, which makes sense, paths to games like League of Legends as well as the path to steamapps are excluded from the attack. The article does not speculate on why this is the case, which leaves me curious and speculating to myself. Is there any readily apparent reason why the malware's creators did this? Or am I just overthinking it? Is it indicative of a target demographic, attack vector, and/ or delivery method? The only potentially obvious reason that I can think of for why this may have been done is so as not to interrupt a distracted gamer, and thus allowing the process to continue to run in the background less likely to be noticed by the user. However, I feel like that is too simple an explanation. I would venture that the average computer user would not recognize the signs of infection even if they weren't engrossed in some game or task on the system. As is intrinsically the case with the vast majority of ransomware, the target demographic is typically the casual user who is less likely to back up their data than a power user who would be more likely to notice the signs of infection, which makes this explanation seem even less likely. Considering most data for many games is not stored locally (with the majority of data that is stored locally also backed up in the cloud, as is the case with Steam) and license keys are now often managed by a digital distribution platform, I can see why it would be almost pointless to encrypt those files.* Even still, I would venture that encrypting those files would further contribute to the sense of invasion/ vulnerability/ loss experienced by the victim. From a social engineering/ psychological standpoint, this would likely increase chances of the victim paying the ransom. Am I just giving the creator(s) too much credit? A move like this seems like a very deliberate thing to do, which leaves me very curious as the motivation.
Recognizing that trying to determine or ascertain Sage coders' actual motivation for their programming decisions will more be a matter of opinion and speculation than fact, my question boils down to two questions that I encountered in speculating:
- What versions of windows are typically targeted? Is it similar to how WannaCry spread, targeting a wide variety of Windows OS's? Or was it more focused on home user OS's (e.g. XP, Vista, 7) versus commercial OS's (e.g. Windows Server 2000, 2008)?
*Speaking mainly about online-only games like League of Legends where the user's profile information is stored online. However, Sage excludes the entire steamapps paths, which is also where save information for local only/ single player games is stored.
UPDATE: Just to clarify, I understand why it makes logical sense to attempt to prevent from encrypting low value, easily replaceable files. However, what I find interesting is the methodology used by the coders to accomplish this. Arguably, you could generate a blacklist the specifies at least a hundred directories where low value data and files are typically stored for various use cases. However, the coders only excluded very specific file paths from encryption. Would it not makes more sense, if your goal is to encrypt as much of the highest value data as possible as quickly as possible, to try to target the encryption to file paths where the most valuable data is most typically stored? This would narrow the scope of the files being encrypted and increase the chances of catching something valuable enough to motivate a user to pay the ransom.