April 18, 2017 • Diana Granger
On March 4, 2017, a member of a top-tier cyber criminal community with the username “Dereck1” mentioned a new ransomware variant called “Karmen.”
Further investigation revealed that “DevBitox,” a Russian-speaking cyber criminal, was the seller behind the Karmen malware on underground forums in March 2017.
However, the first cases of infections with Karmen were reported as early as December 2016 by victims in Germany and the United States.
The Karmen malware derived from “Hidden Tear,” an open source ransomware project, available for purchase by anyone. As is typical for ransomware infections, Karmen encrypts files on the infected machine using the strong AES-256 encryption protocol, making them inaccessible to the user and may trigger a ransom note or instructions demanding that the user pay a large sum of money to obtain the decryption key from the attacker.
A notable feature of Karmen is that it automatically deletes its own decryptor if a sandbox environment or analysis software is detected on the victim’s computer.
Here are screenshots of the affiliate’s page seen by purchasers of Karmen. Configuration of Karmen through this interface allows actors to change the malware’s settings using a control panel that requires very minimal technical knowledge.
The “Clients” page allows for tracking of computers infected with the virus, including the status of any ransom that’s been paid.
The dashboard gives an overview of other relevant information including the number of clients they have, how much money they’ve earned, and updates to the Karmen software.
On the computer of a user infected with Karmen the above message is displayed, warning them not to interfere with the malware.
*Or if an analyzing software is detected
File Name: joise.exe
File Name: n_karmen.exe
File Name: build.exe
File MD5: 9c8fc334a1dc660609f30c077431b547
File MD5: 56b66af869248749b2f445be8f9f4a9d
File MD5: 521983cb92cc0b424e58aff11ae9380b
The seller has admitted he was only involved with web development and control panel design; the malware is utilizing the open source encryption project “Hidden Tear” and was created by an unknown associate operating out of Germany.
As of this writing, 20 copies of Karmen malware were sold by DevBitox, while only five copies remain available to potential buyers.