Apostle

Apostle achieves persistence by creating a scheduled task, such as MicrosoftCrashHandlerUAC.

Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files.

Apostle writes batch scripts to disk, such as system.bat and remover.bat, that perform various anti-analysis and anti-forensic tasks, before finally deleting themselves at the end of execution. Apostle attempts to delete itself after encryption or wiping operations are complete and before shutting down the victim machine.

Apostle compiled code is obfuscated in an unspecified fashion prior to delivery to victims.

Apostle's ransomware variant requires that a base64-encoded argument is passed when executed, that is used as the Public Key for subsequent encryption operations. If Apostle is executed without this argument, it automatically runs a self-delete function.

Apostle initially masqueraded as ransomware but actual functionality is a data destruction tool, supported by an internal name linked to an early version, wiper-action. Apostle writes random data to original files after an encrypted copy is created, along with resizing the original file to zero and changing time property metadata before finally deleting the original file.

Apostle creates new, encrypted versions of files then deletes the originals, with the new filenames consisting of a random GUID and ".lock" for an extension.

Apostle reboots the victim machine following wiping and related activity.

Apostle searches for files on available drives based on a list of extensions hard-coded into the sample for follow-on wipe activity.

Apostle will attempt to delete all event logs on a victim machine following file wipe activity.