WastedLocker

WastedLocker is a malicious software, or malware, developed in 2020 by the Evil Corp Group. It's a phone ransomware that targets both Windows and Android devices, capable of exploiting and damaging your computer or device without your knowledge. WastedLocker is a part of a lineage of malware that includes DoppelPaymer (developed in 2019) and utilizes a Delphi-based crypter known as CryptOne, which dates back to 2015. CryptOne has been used with various other malware families such as Gozi, Dridex, NetWalker, and indeed WastedLocker. The attackers have previously employed SocGholish to target numerous newspaper websites operated by a U.S. media company. SocGholish has been used as a primer for several ransomwares, including WastedLocker, LockBit, Drydex, Hive, among others. A unique feature of WastedLocker is its ability to detect and disable a list of security software, using samples crypted by the CryptOne crypter. Unlike many malwares that target specific extensions, WastedLocker includes a list of directories and extensions to exclude from the encryption process. A variant of WastedLocker, Hades ransomware, uses a different User Account Control (UAC) bypass than WastedLocker. However, both implementations are sourced directly from the open-source UACME project. Interestingly, Hades writes a single ransom note named "HOW-TO-DECRYPT-[extension].txt" to traversed directories, contrasting WastedLocker’s approach of creating a note for each encrypted file. The continued development of WastedLocker ransomware signifies the persistent attempts by its creators to distance themselves from known tooling to aid in bypassing sanctions imposed on them.