Ransomware - Golden Axe

The Golden Axe ransomware doesn't appear to be inspired by the 1989 Sega classic of the same name. However, there's no way of knowing. The threat actors behind this crypto-ransomware variant disseminated Golden Axe sometime in March, and it was discovered by Twitter user @tkanalyst on March 17, 2019. @tkanalyst noted that the ransomware payload was distributed via malvertising. Once executed, the ransomware performs its assumed actions by encrypting files and dropping a ransom note. However, Golden Axe has a few unique characteristics. The first is that the file extension used is a unique 5-alphanumeric sequence that is calculated dynamically; therefore, each time you run the ransomware, you will end up with a different 5-character string. This string is used to append to the end of encrypted files and is used in the ransom note names, of which there are three:

• an image of a ransom note: # instructions-<5-alphanumeric character ID>.jpg
• a ransom note text file: # instructions-<5-alphanumeric character ID>.txt
• a VBS file that, when executed, plays a soundbite letting you know your files have been encrypted: # instructions-<5-alphanumeric character ID>.vbs

The only known sample we found is denoted by the SHA-256 hash: c40ba66fd4c3061429b092d378da5f6a648edc38e8be83992fdb77fb6200dbe2. We analyzed the UPX packed sample, unpacked it, and extracted a few characteristics, which are shown below. It was written in GoLang and used a hybrid encryption technique with the RC4 stream cipher encrypting the files and RSA encrypting the RC4 cipher key.