Skip to main content
Maze Ransomware

As of October 2020, Maze appears to be non-functional, with the group operating it seemingly moving to the Egregor ransom tool.

Report a cyber attack: call 0300 303 5222 or email carecert@nhsdigital.nhs.uk

Summary

As of October 2020, Maze appears to be non-functional, with the group operating it seemingly moving to the Egregor ransom tool.


Affected platforms

The following platforms are known to be affected:

Threat details

Introduction

Maze, also known as ChaCha, is a newly observed ransomware tool that will alter its demanded ransom depending on the type of device it has infected.


Delivery

At the time of publication, Maze has only been observed being delivered by the Fallout exploit kit via compromised cryptocurrency sites.


Activities

Once installed, Maze will encrypt all non-system files using individual ChaCha20 keys, themselves encrypted using a master RSA key, before appending randomised extensions to each file. It will then attempt to determine the type of device it is installed on before displaying a separate ransom notes based on the device's perceived value.


Threat updates

Date Update
30 Oct 2020 Maze shutting down

The group behind Maze has announced to several cybersecurity researchers that they are ceasing operations.

Whilst it is unclear why they are doing this, there is evidence suggesting they have shifted their efforts to the newer Egregor ransomware .

24 Sep 2020 VM encryption routine

The latest version of Maze now uses an embedded VirtualBox instance with a custom Windows 7 virtual machine to encrypt targeted files. This is likely done to avoid detection from certain security services.

It appears this behaviour has been taken from Ragnar Locker, another ransomware tool with known links to Maze's operators.


Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

  • Critical data is frequently saved in multiple backup locations.
  • At least one backup is kept offline at any time (separated from live systems).
  • Backups and incident recovery plans are tested to ensure that data can be restored when needed.
  • User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
  • Infected systems are disconnected from the network and powered down as soon as practicable.
  • Any user account credentials that may have been compromised should be reset on a clean device
  • Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.


Indicators of compromise

Network indicators

IP addresses

  • 104[.]168[.]174[.]32
  • 104[.]168[.]198[.]208
  • 104[.]168[.]201[.]35
  • 104[.]168[.]201[.]47
  • 104[.]168[.]215[.]54
  • 104[.]18[.]40[.]94
  • 149[.]56[.]245[.]196
  • 173[.]209[.]43[.]61
  • 192[.]119[.]106[.]235
  • 192[.]99[.]172[.]143
  • 193[.]36[.]237[.]173
  • 37[.]1[.]213[.]9
  • 37[.]252[.]7[.]142
  • 5[.]199[.]167[.]188
  • 54[.]39[.]233[.]188
  • 91[.]208[.]184[.]174
  • 91[.]218[.]114[.]11
  • 91[.]218[.]114[.]25
  • 91[.]218[.]114[.]26
  • 91[.]218[.]114[.]31
  • 91[.]218[.]114[.]32
  • 91[.]218[.]114[.]37
  • 91[.]218[.]114[.]38
  • 91[.]218[.]114[.]4
  • 91[.]218[.]114[.]77
  • 91[.]218[.]114[.]79
  • 92[.]63[.]11[.]151
  • 92[.]63[.]15[.]56
  • 92[.]63[.]15[.]6
  • 92[.]63[.]15[.]6 
  • 92[.]63[.]15[.]8
  • 92[.]63[.]15[.]8 
  • 92[.]63[.]17[.]245
  • 92[.]63[.]194[.]20
  • 92[.]63[.]194[.]3
  • 92[.]63[.]29[.]137
  • 92[.]63[.]32[.]2
  • 92[.]63[.]32[.]2 
  • 92[.]63[.]32[.]52
  • 92[.]63[.]32[.]55
  • 92[.]63[.]32[.]57
  • 92[.]63[.]37[.]100
  • 92[.]63[.]8[.]47

URLs

  • 104[.]168[.]174[.]32/wordupd_3[.]0[.]1[.]tmp
  • 104[.]168[.]198[.]208/wordupd[.]tmp
  • 104[.]168[.]201[.]35/dospizdos[.]tmp
  • 104[.]168[.]201[.]47/wordupd[.]tmp
  • 104[.]168[.]215[.]54/wordupd[.]tmp
  • 149[.]56[.]245[.]196/wordupd[.]tmp
  • 192[.]119[.]106[.]235/mswordupd[.]tmp
  • 192[.]119[.]106[.]235/officeupd[.]tmp
  • 192[.]99[.]172[.]143/winupd[.]tmp
  • 54[.]39[.]233[.]188/win163[.]65[.]tmp
  • 91[.]208[.]184[.]174:8079/windef[.]exe
  • agenziainformazioni[.]icu/wordupd[.]tmp
  • aoacugmutagkwctu[.]onion
  • checksoffice[.]me
  • download-invoice[.]site/Invoice_29557473[.]exe
  • drivers[.]updatecenter[.]icu
  • mazedecrypt[.]top 
  • mazenews[.]top
  • newsmaze[.]top
  • plaintsotherest[.]net
  • thesawmeinrew[.]net
  • updates[.]updatecenter[.]icu

Host indicators

Filenames

  • 17269b5.exe
  • 3686576.exe
  • 4ffcc27.exe
  • 5f83030.exe
  • 8e6ce49.exe
  • ac2c822.exe
  • argfdg
  • arsgt35yy
  • Attack!.rar
  • Ave Kim
  • DECRYPT-FILES.html
  • Emperor.exe
  • foo.dat
  • HONClients.exe
  • jarvey.exe
  • jarvey.exe
  • KarriBillabong.dll
  • kepstl32.dll
  • kinput.dll
  • lckwmi.bat
  • lckwmi.bat
  • love.dll
  • maze.dll 
  • maze.exe
  • memes.tmp 
  • mrtscp64.exe
  • mrtscp64.exe
  • version.dll

MD5 hashes

  • 064058cf092063a5b69ed8fd2a1a04fe
  • 078cf6db38725c37030c79ef73519c0c
  • 0f841c6332c89eaa7cac14c9d5b1d35b
  • 108a298b4ed5b4e77541061f32e55751
  • 11308e450b1f17954f531122a56fae3b
  • 11308e450b1f17954f531122a56fae3b 
  • 15d7dd126391b0e7963c562a6cf3992c
  • 1fef99f05bf5ae78a28d521612506057
  • 21a563f958b73d453ad91e251b11855c
  • 27c5ecbb94b84c315d56673a851b6cf9
  • 2f78ff32cbb3c478865a88276248d419
  • 335aba8d135cc2e66549080ec9e8c8b7
  • 3a5a9d40d4592c344920dd082029b362
  • 3bfcba2dd05e1c75f86c008f4d245f62
  • 46b98ee908d08f15137e509e5e69db1b
  • 4ccca6ff9b667a01df55326fcc850219
  • 4f57e35a89e257952c3809211bef78ea
  • 5774f35d180c0702741a46d98190ff37
  • 5df79164b6d0661277f11691121b1d53
  • 658e9deec68cf5d33ee0779f54806cc2
  • 65cf08ffaf12e47de8cd37098aac5b33
  • 7507fe19afbda652e9b2768c10ad639f
  • 76f8f28bd51efa03ab992fdb050c8382
  • 79d137d91be9819930eeb3876e4fbe79
  • 7cbe21495c10534817ed428ddc030fe9
  • 8045b3d2d4a6084f14618b028710ce85
  • 8205a1106ae91d0b0705992d61e84ab2
  • 83b8d994b989f6cbeea3e1a5d68ca5d8
  • 868d604146e7e5cb5995934b085846e3
  • 87239ce48fc8196a5ab66d8562f48f26
  • 89e1ddb8cc86c710ee068d6c6bf300f4
  • 910aa49813ee4cc7e4fa0074db5e454a
  • 9eb13d56c363df67490bcc2149229e4c
  • a0c5b4adbcd9eb6de9d32537b16c423b
  • a3a3495ae2fc83479baeaf1878e1ea84
  • a93b86b2530cc988f801462ead702d84
  • b02be7a336dcc6635172e0d6ec24c554
  • b40a9eda37493425782bda4a3d9dad58
  • b4d6cb4e52bb525ebe43349076a240df
  • b6786f141148925010122819047d1882
  • b93616a1ea4f4a131cc0507e6c789f94
  • bad6fc87a98d1663be0df23aedaf1c62
  • bd9838d84fd77205011e8b0c2bd711e0
  • be537a66d01c67076c8491b05866c894
  • bf2e43ff8542e73c1b27291e0df06afd
  • c255daaa8abfadc12c9ae8ae2d148b31
  • c3ce5e8075f506e396ee601f2757a2bd
  • c818cc38f46c604f8576118f12fd0a63
  • cebe4799b6aff9cead533536b09fecd1
  • d2dda72ff2fbbb89bd871c5fc21ee96a
  • d3eaab616883fcf51dcbdb4769dd86df
  • d552be44a11d831e874e05cadafe04b6
  • deebbea18401e8b5e83c410c6d3a8b4e
  • dfa4631ec2b8459b1041168b1b1d5105
  • e57ba11045a4b7bc30bd2d33498ef194
  • e69a8eb94f65480980deaf1ff5a431a6
  • ef95c48e750c1a3b1af8f5446fa04f54
  • f04d404d84be66e64a584d425844b926
  • f457bb5060543db3146291d8c9ad1001
  • f5ecda7dd8bb1c514f93c09cea8ae00d
  • f5ef96251f183f7fc63205d8ebf30cbf
  • f83cef2bf33a4d43e58b771e81af3ecc
  • fad3c6914d798e29a3fd8e415f1608f4
  • fba4cbb7167176990d5a8d24e9505f71

SHA256 hashes

  • 0606c6d918e0c02cea5fd85bfeb862c8ffe3eee4ef059cd8d2cd3ff342fdf9d9
  • 19aaa6c900a5642941d4ebc309433e783befa4cccd1a5af8c86f6e257bf0a72e 
  • 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd
  • 3c2be967cbaaafecf8256167ba32d74435c621e566beb06a1ead9d33d7e62d64
  • 3fd37d42d5821a8cbcf930255ca1259a680937e4e7dfa2d535d56121187806c2
  • 4218214f32f946a02b7a7bebe3059af3dd87bcd130c0469aeb21b58299e2ef9a
  • 4acba1590552c9b2b82f5a786cedc8a12ca457e355c94f666efef99073827f89
  • 4e1f7d397a07477bc3da1e1185a5960475817e9d04529b5bcc2068830262fa1b
  • 5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b
  • 67f338c9f15b000aedac1d736fbce1ab27fd72a10d397315ba724b1dccf4e834
  • 6878f7bd90434ac5a76ac2208a5198ce1a60ae20e8505fc110bd8e42b3657d13
  • 6d4836c75092d75f1d3a1d90100f19247473f9b0d7e12602221a7badf7feb29d
  • 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6
  • 92125cc9aec53e2e7d0a67e8a53f0d6cb4a33f9ca73243d66b0397d7ddec907e
  • 94673f34efc32e73523f8435acf0afce782ba4f68e9f71f80afbeb3b917162f3
  • 9845f553ae868cd3f8d8c3f8684d18f226de005ee6b52ad88b353228b788cf73
  • 9ad15385f04a6d8dd58b4390e32d876070e339eee6b8da586852d7467514d1b1
  • abb36315ed6f708ba60c8cf70fdc0e327f7fbcfdfe33a403827e47a0155d1e4f
  • b27bfa476a6915e573583c63b1d898913472ed86f224d5c470051359ceff8828
  • b950db9229db2f37a7eb5368308de3aafcea0fd217c614daedb7f334292d801e
  • c84b2c7ec20dd835ece13d5ae42b30e02a9e67cc13c831ae81d85b49518387b9
  • d215134b504790b3a3850e4e28a056a5eb2afdd057828626838507792476a74d
  • e49225cc26ec911a213eb942d7797e8eec6de3f793abc8bb30f4b89f14e72d96
  • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684
  • eed70e8b4425aea2c6cd37c06c8789acbc049269d6f56d8968787383e82d23dc
  • f97bda917e52379ae9fe06605e4f120f9c88aebea38d3b4aeb3c21d476ea4d39
  • fe0a5682abc92037d79318d3f5bc6a920df2ceafaa5f1869406ee842c422f0e9 

Last edited: 30 October 2020 1:56 pm