The Annabelle Ransomware Is a Horrific Mess

[Solarquest]

While most ransomware is created to actually generate revenue, some developers create them to show off their "skills". Such is the case with a new ransomware based off of the horror movie franchise Annabelle.

Discovered by security researcher Bart, Annabelle Ransomware includes everything but the kitchen sink when it comes to screwing up a computer. This includes terminating numerous security programs, disabling Windows Defender, turning off the firewall, encrypting your files, trying to spread through USB drives, making it so you can't run a variety of programs, and then to sweeten the pot, it overwrites the master boot record of the infected computer with a silly boot loader.
...
...

The good news is that this ransomware is based off of Stupid Ransomware and is easily decryptable. As it uses a static key, Michael Gillespie was able to update his StupidDecryptor in order to decrypt this variant.

By replacing the MBR, running Rkill in safe mode to clean up the IFEO registry entries, using Michael's decryptor to decrypt the files, and then a few security scans to remove any left overs you shouldbe able to get your computer back to normal.
...

VirusTotal

 

[Faybert]

This includes terminating numerous security programs, disabling Windows Defender, turning off the firewall.
...

Spooky, a sample of this would be good for testing the behavioral blocker

 

[Deleted member 65228]

Spooky, a sample of this would be good for testing the behavioral blocker

Any security software which cannot protect the MBR in 2018 is awful IMO. So some vendors are in the clear but hardly many xD

 

[Faybert]

Any security software which cannot protect the MBR in 2018 is awful IMO. So some vendors are in the clear but hardly many xD

Security companies live by saying that your AV will detect everything, that you will always be protected against ransomware and etc, but in practice we know that this is not true, so things have to be proven in practice, I've seen many AV detect a sample and after I just renomer it, it did not detect anymore, being that the malicious code is the same but by just having changed the name it seems that it got confused, are unexpected things that can happen with an AV,then it is always valid to test to prove.

 

[Solarquest]

@silversurfer might have found one and posted it in the HUB.

 

[minegroasprilla]

mm, bad Kaspersky:
Antivirus scan for 7a243bcbff4309eafd287ecc124606171724da76fc3c1896002e5f7392b13df3 at 2018-02-21 20:46:26 UTC - VirusTotal

 

[Evjl's Rain]

mm, bad Kaspersky:
Antivirus scan for 7a243bcbff4309eafd287ecc124606171724da76fc3c1896002e5f7392b13df3 at 2018-02-21 20:46:26 UTC - VirusTotal

updated result
VirusTotal

not detecting in VT doesn't mean the AV doesn't detect in real test because the way they provide the engine to VT is different from their own engine
I recently tested Malwarebytes and in VT, it didn't detect the sample (recently updated in <1 minute) but when I scanned with MB in the VM, MB got the signature for it

BD, for example, detected the malware on VT but in the updated system, it couldn't detect by signature

 

[Sunshine-boy]

bad

What do you mean?maybe the VT didn't update the Kaspersky engine? or maybe VT don't use Kaspersky could and it only use Kaspersky
signature database.

 

[Electr0n]

Any security software which cannot protect the MBR in 2018 is awful IMO. So some vendors are in the clear but hardly many xD

Backups are best defence against ransomwares. There are softwares like MBRwizards which can backup the MBR. Never used it before, but looks like with regular image backups we will have to backup MBR too.

 

[BigWrench]

Sadly....... And not sadly.....

 

[DeepWeb]

Windows Defender says it's A-ok of course.

 

[jackuars]

Doesn't the VirusTotal results show that if they will be detected by the signature's and not the other shields that an antivirus has? They could block it on execution if am not wrong? I'd be interested to know if the big names (like Qihoo/WD) in the "did not block" list for this ransomware actually detected and killed it through other shields.

 

[harlan4096]

I already tested (yesterday) that sample uploaded by @silversurfer, at that moment Kaspersky didn't detect it on demand, but did it in dynamic, results at MWHub already posted

 

[Aleeyen]

I think if an AV cannot detect a new threat using its signature but can detect it using its behavior blocker, then its better. That means that even if the signature is not updated by the user then also the user is safe and also the user may be well protected against threats like this in the future. Just my opinion.

 

[WinXPert]

Tested it with 360TS. Not detected on Static scan but blocked on execution. I like to see how it behaves but I got a BSOD 0x0F4 when I allowed the process. There goes my screenshots.

I think if an AV cannot detect a new threat using its signature but can detect it using its behavior blocker, then its better. That means that even if the signature is not updated by the user then also the user is safe and also the user may be well protected against threats like this in the future. Just my opinion.

Kaspersky (see @harlan4096 post) and 360 blocked it even thought it was not detected static scan.

 

[jackuars]

Tested it with 360TS. Not detected on Static scan but blocked on execution. I like to see how it behaves but I got a BSOD 0x0F4 when I allowed the process. There goes my screenshots.




Kaspersky (see @harlan4096 post) and 360 blocked it even thought it was not detected static scan.

Thank you WinXPert. So my assumption wasn't wrong. It's not so bad even if they don't record a "GREEN" sign in VT results as long as they do their job. It's wrong to judge the ability of an antivirus from VT results.

Btw can you test it for Windows Defender too?

 

[WinXPert]

Thank you WinXPert. So my assumption wasn't wrong. It's not so bad even if they don't record a "GREEN" sign in VT results as long as they do their job. It's wrong to judge the ability of an antivirus from VT results.

Btw can you test it for Windows Defender too?

Yes I noticed that Qihoo is not included on the list that can detect the malware at the time of testing but it's BB did block the malware.

Test with WD, I'll see what I can do