Executive Summary
Analysis of Liushen ransomware reveals a sophisticated Python-based framework packed as an executable. The malware employs multiple evasion layers to bypass sandboxes and debuggers, including timing checks, RAM/CPU core verification, and direct PEB inspection for the NtGlobalFlag. It is designed to maximize impact by terminating security and productivity processes, disabling Windows Defender, and deleting Volume Shadow Copies before initiating file encryption with AES-256-CBC.
Technically, Liushen stands out for its multi-platform capabilities (Windows and Linux) and its high-privilege operations, such as overwriting the Master Boot Record (MBR) on Windows systems to display a ransom message during boot. It maintains persistence through various methods, including Registry Run keys, Scheduled Tasks, and WMI event subscriptions. Following successful encryption, it exfiltrates the master key and victim metadata via SMTP or HTTP C2 servers to facilitate ransom negotiations.
This threat is high-impact due to its comprehensive approach to system sabotage, including the disabling of UAC and Windows Updates, and its ability to self-destruct to hinder forensic analysis. Organizations should prioritize monitoring for the specific process hollowing and shadow copy deletion behaviors identified in this report.