The server then responds to the findings reported by the initial script by uploading the initial payload. This varies based on the details gleaned, but generally includes some type of banking trojan malware and a backdoor such as Dridex, NetSupport Manager RAT, or similar. If the initial scan reveals that the target computer is part of a corporate network, then an additional payload is also injected onto the target machine, but we’ll get to that in a moment.
The first part of the payload will busily ferret out login credentials and other sensitive information, exfiltrating any files of value back to the command and control server.
Only when this operation has been completed and if the computer is part of a corporate network will the second stage we referenced earlier trigger, which is a strain of ransomware, normally BitPaymer or DoppelPaymer. The ransomware spreads through the network as far as it is able, encrypting files network wide.
These two ransomware strains are known for their hefty ransom demands, which often run into the hundreds of thousands, or even millions of dollars.
This multi-stage approach is dreadfully effective. It not only allows the hackers to squeeze a wide range of sensitive data from infected systems, but then, locks them down hard and demands a hefty payment. Be sure your staff is aware. This one’s about as dangerous as they come.