From the Labs: YARA Rule for Detecting Lorenz

ReversingLabs analysts are constantly working to respond to new threats and provide our customers with information and tools to defend their systems from attacks. Written by our threat analysts, our high-quality, open source YARA rules help threat hunters, incident responders, security analysts, and other defenders detect malicious behavior in their environment.

In this series, we break down some of the threats behind our YARA detection rules that can help your organization detect threats within your environment.

Lorenz: A Persistent, Money-Driven Operation

The Lorenz ransomware operation has been active since April of 2021, and has been attacking victims globally since. Like other “double extortion” ransomware groups, Lorenz steals data from its ransomware victims and operates a leak site where they publish their victims’ data, showing proof that they infiltrated their networks.

This operation is unique, compared to other ransomware gangs, in that it initially makes the stolen data available for sale to other threat actors or possible competitors while also demanding a ransom from the victim. Lorenz does this by releasing password-protected RAR archives containing the victim’s data. The group will then publicly release the password for the data leak archives if the victim did not pay the ransom and if the data was not purchased by another entity.

Another differentiating factor that makes Lorenz stand out in the ransomware field is that it sells data on its victims’ internal networks, which some actors find to be of more value than a victim’s data, according to BleepingComputer’s analysis of Lorenz’s leak site.

Deploying the Ransomware

According to researcher Michael Gillespie of ID Ransomware, the encryptor that Lorenz uses is the same one that ThunderCrypt, a previous ransomware group, used in their attacks. It is not known however if these groups are related, or if Lorenz purchased the ransomware source code to create its own variant, according to BleepingComputer.

Based on 2021 samples seen by BleepingComputer, the ransomware operation customizes the malware executable for the specific victim they are targeting, taking a more targeted approach. Lorenz then uses AES encryption once it infects a network, as well as an embedded RSA key to encrypt the encryption key. All encrypted files are then given the .Lorenz.sz40 extension. In one of the samples BleepingComputer analyzed, they found that Lorenz did not kill processes or shut down Windows services before encrypting the network’s files.