Sage 2.0 Ransomware

Posted: February 22, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	2,647

First Seen:	December 5, 2016
Last Seen:	October 22, 2024
OS(es) Affected:	Windows

The Sage 2.0 Ransomware is an updated variant of the Sage Ransomware, a Trojan that locks your files behind an encryption cipher to collect ransom payments. Although free data recovery for threats of this type may be impossible, keeping backups on a non-local drive can give you options for restoring any content without paying a con artist. Anti-malware products also can delete the Sage 2.0 Ransomware before it installs itself through its confirmed infection vector of spam e-mails.

Sages Studying Up on How to Infect Your PC

In late 2016, the early versions of the Sage Ransomware were limited in supply. They were used in-browser exploits operating through the RIG Exploit Kit to install themselves onto vulnerable PCs through compromised websites. However, the threat industry moves at a fast pace. Already, malware analysts take note of a new version of the threat, the Sage 2.0 Ransomware, seemingly upgrading its distribution model for the sake of extorting money from its file-locking attacks.

The Sage 2.0 Ransomware uses the more traditional method of e-mail attachments, obfuscated through ZIP archives, to compromise new computers. The Trojan droppers are JavaScript and Word-based and conceal the Sage 2.0 Ransomware's main installation file in the Windows 'Temp' folder. Although malware experts can confirm the Sage 2.0 Ransomware as being a persistent threat that relaunches itself through scheduled task exploits, it accomplishes the bulk of its payload immediately after the install routine.

The Sage 2.0 Ransomware encrypts a list of hundreds of file formats, including highly specialized ones, as well as general-purpose ones like documents. It deletes the default Windows backups with a simple admin command and displays two types of ransom notes: a desktop wallpaper and an HTML text file. Both messages recommend paying a ransom for recovering your content through the Sage 2.0 Ransomware's Web decryption service, which uses the TOR Browser. At an equivalent of two thousand dollars, the Sage 2.0 Ransomware's campaign demands a payment that is among the highest malware experts have seen.

Protecting Yourself from a Wise Guy of a Trojan

Even though it infiltrates your PC in a new way, the Sage 2.0 Ransomware operates under most of the same principles guiding previous Sage Ransomware attacks. The cyber security industry has yet to discover free decryption solutions for this family and con artists may not provide any services after taking their ransoms (which, via Bitcoin, are non-refundable). Accordingly, having a backup that the Sage 2.0 Ransomware can't delete is highly valuable for keeping this Trojan's payload from holding the contents of your PC hostage.

The Sage 2.0 Ransomware doesn't uninstall itself and will restart with your PC. Before removing the Sage 2.0 Ransomware with an appropriate anti-malware product, boot your computer by using the Safe Mode feature or an external drive. Unfortunately, any encrypted files, while identifiable by their '.sage' extensions are irretrievable without the decryption key the Sage 2.0 Ransomware's authors are selling.

Since the Sage 2.0 Ransomware's threat actors have an appearance of non-negligible experience in their field, this campaign is likely to be just one of several for the near future. With the climbing rates of Trojan ransoms, backing up your files is becoming an increasingly inexpensive chore to ignore.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 287.87 KB (287872 bytes)
MD5: c167732d2390deb95b081c97caf23cc2
Detection count: 90
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 3, 2017

dir\name.exe

File name: name.exe
Size: 360.53 KB (360538 bytes)
MD5: 5c57696e646f776563757465646e6465
Detection count: 44
File type: Executable File
Mime Type: unknown/exe
Path: dir
Group: Malware file
Last Updated: February 1, 2017

%APPDATA%\f1.hta

File name: f1.hta
Size: 102.11 KB (102119 bytes)
MD5: 22dda250b1f467bdc19d4075c9da1327
Detection count: 23
Mime Type: unknown/hta
Path: %APPDATA%
Group: Malware file
Last Updated: April 15, 2017

%USERPROFILE%\Start Menu\Programs\Startup\!HELP_SOS.hta

File name: !HELP_SOS.hta
Size: 102.11 KB (102119 bytes)
MD5: b339f1cdfd77aeb604727798e33af202
Detection count: 21
Mime Type: unknown/hta
Path: %USERPROFILE%\Start Menu\Programs\Startup
Group: Malware file
Last Updated: April 15, 2017

%APPDATA%\bSgt9RXM.exe

File name: bSgt9RXM.exe
Size: 106.5 KB (106508 bytes)
MD5: cdf028573073e55ee536cd748dcd064e
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: December 5, 2016

More files

Registry Modifications

The following newly produced Registry Values are:

File name without path!HELP_SOS.htaRegexp file mask%APPDATA%\f[NUMBERS].hta