PythonAnywhere Cloud Platform Abused for Hosting Ransomware

Razr ransomware is exploiting PythonAnywhere to distribute and encrypt files with AES-256. ANY.RUN’s analysis reveals its behaviour, C2 communication, and ransom demands via Tor. Protect your systems with ANY.RUN’s free malware analysis tools and stay ahead of this threat.

ANY.RUN researchers have recently uncovered a ransomware campaign where attackers are exploiting the PythonAnywhere cloud platform to host and distribute malicious files. This campaign involves the Razr ransomware, which uses PythonAnywhere’s infrastructure to discreetly and effectively target victims.

Ransomware Behavior Overview

In a detailed analysis conducted by ANY.RUN, it was found that Razr ransomware begins its operation by generating a unique machine ID, an encryption key, and an Initialization Vector (IV). 

The victim’s ID, IV and encryption key are displayed in ANY.RUN sandbox

These crucial details are then sent to a C2 server in unencrypted JSON format. Using ANY.RUN’s MITM (Man-in-the-Middle) feature, researchers were able to intercept and decrypt this data, providing valuable insights into the ransomware’s functioning.

According to the research, the malicious file is hosted on the xmb.pythonanywherecom subdomain of PythonAnywhere. The latter is a legitimate platform designed for running Python code and web applications directly in the cloud. 

Razr Encryption Process

The Razr ransomware uses the AES-256 encryption algorithm in CBC (Cipher Block Chaining) mode to encrypt the victim’s files. This is a strong encryption method that locks the files, making it nearly impossible for the victim to access them without the decryption key, which the attackers hold for ransom.

As shown in this sandbox analysis session, the attackers inform their victims about the encryption of the files through the advanced AES-256 technique and demand a certain amount of money to decrypt the files.

Razr ransomware analyzed with ANY.RUN sandbox

The sandbox analysis session from ANY.RUN revealed the ransomware’s behaviour in real-time, providing the following information:

Systematic file encryption with the AES-256 algorithms Malicious threat hosted on the legitimate PythonAnywhere subdomain to evade detection A ransom note with instructions to visit a specific Tor domain and make the payment Ransomware’s behaviour in real-time.

A Deeper Investigation Into Razr Ransomware Analysis

Besides, ANY.RUN’s TI Lookup service further revealed that a public analysis session had been conducted where a user examined reports hosted on the same PythonAnywhere subdomain.

Malicious file analyzed with ANY.RUN sandbox

The report identifies multiple webhooks being redirected to Discord. Interestingly, the number of hashes in the report matches the number of webhooks, suggesting that each webhook may be uniquely used based on its corresponding hash.

Public sandbox session in ANY.RUN

As you can see, ANY.RUN disclosed all the necessary technical details of the PythonAnywhere abuse to help potential victims recognize the threat and implement protective measures.

Expose Ransomware Right in Your Browser

Protect your business against advanced ransomware threats like Razr. Sign up for a free ANY.RUN account today to access unlimited malware analysis and stay one step ahead of cyber attackers.

RELATED TOPICS

PyPI Exploited to Infiltrate Systems Through Python Packages NTLM Credential Theft in Python Apps Risk Windows Security Python in Threat Intel: Analyzing and Mitigating Cyber Threats Qubitstrike Malware Hits Jupyter Notebooks for Cryptojacking VMCONNECT: Malicious PyPI Package Mimicking Python Tools New version of Jupyter infostealer delivered through MSI installer