Zarok Ransomware: A Chaos-Family Variant with Large-File Destruction

Background

We recently observed a new ransomware family tagged “Zarok” on our automated analysis platform. Closer analysis confirms Zarok was not built from scratch but is a variant on top of the Chaos builder and BlackSnake Ransomware — a textbook low-barrier repackaging case. Beyond traditional encryption, it adds large-file destruction, recovery-capability destruction, and clipboard hijacking targeting cryptocurrency addresses, causing further asset loss.

Field	Value
Filename	Zarok Ransomware.exe
Size	178 KB (182,272 bytes)
Platform	32-bit .NET EXE (C# / .NET Framework)
Compiled	2025-11-09
Family	Variant of the Chaos / MSIL.Filecoder.Chaos family

This report is intended only for defensive research, incident response, threat hunting, and educational purposes. The samples and tools referenced may be dangerous; test them only in isolated, restorable environments that are not connected to a production network. Third-party platform and product names are used only for technical description.

Infection flow overview

Based on entry-point analysis, Zarok’s execution is highly linear and uses many Cyrillic characters as function and class names. It divides into seven stages:

1. Preparation: checks the keyboard language, confirms whether it is a repeat run, creates an infection marker, and starts clipboard and disk-monitoring threads.
2. Elevation: copies itself to %AppData%\winit32.exe and requests administrator rights via UAC runas.
3. Persistence: adds a Run-key entry so it auto-starts after reboot.
4. Defense bypass and recovery destruction: deletes Volume Shadow Copies, disables Windows Recovery, deletes the backup catalog, and disables Task Manager and several backup/security services.
5. Encryption and destruction: walks the drives, skips system directories, targets specific extensions, and by size decides whether to encrypt or overwrite.
6. Post-encryption: drops a same-named executable in each drive root, writes the ransom note, and sets a ransom wallpaper.
7. Clipboard hijack (resident): continuously monitors the clipboard and swaps any Bitcoin address for the attacker’s wallet.

Technical analysis

Environment detection and single-instance protection

Keyboard-language check — the program reads the current keyboard layout via InputLanguage.CurrentInputLanguage.Culture.Name. If it detects az-Latn-AZ (Azerbaijani) or tr-TR (Turkish), it treats the environment as forbidden, shows a “Forbidden Country” message, and exits. This region-avoidance logic is common in Russian-speaking-scene ransomware, usually tied to the actor’s local legal risk or underground rules.

Infection marker and clipboard-monitor init — it creates the subkey oAnWieozQPsRK7Bj83r4 under HKCU\Software as an “already run” marker (BlackSnake uses the same key, a linkage indicator), and starts a background thread loading the driveNotification class to watch the clipboard and newly mounted drives.

Single-instance control — it checks whether %AppData%\winit32.exe and %AppData%\README_NOW_ZAROK.txt exist to judge whether the system is already encrypted; it also walks the process list and exits if it finds an instance with the same path but a different PID, avoiding double encryption and resource contention.

Elevation and persistence

Zarok first copies itself to %AppData%\winit32.exe, then uses UseShellExecute with runas to request administrator rights; if the user declines the UAC dialog, it keeps retrying until granted or manually terminated. Once elevated, it adds a Run entry named UpdateTask under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing at winit32.exe, ensuring it restarts at every logon.

Defense bypass and recovery destruction

When a control flag is enabled, Zarok runs a series of system commands to strip the victim of self-recovery:

vssadmin delete shadows /all /quiet
wmic shadowcopy delete
bcdedit /set {default} bootstatuspolicy ignoreallfailures
bcdedit /set {default} recoveryenabled no
wbadmin delete catalog -quiet

Together with disabling Task Manager and stopping common backup/protection/AV services, the victim environment can barely recover quickly through built-in features after encryption, raising ransom pressure.

File encryption and destruction strategy

Directory and file filtering — Zarok skips core system directories (Program Files, Windows, ProgramData, $Recycle.Bin, etc.) and excludes files whose names contain backup, some database services, or system keywords, to avoid crashing the system immediately and raise the ransom success rate; the targeted extensions cover office documents, images, archives, source code, virtual disks, and more.

Encryption for small and mid-size files (under ~2.3 GB) — it generates a 40-character random password as the AES key source, derives the AES key and IV from a fixed 8-byte salt via PBKDF (AES-128-CBC + PKCS7), and structures the encrypted file as below, then overwrites the entire original file with the fixed byte 0x3F and deletes it:

[8-byte fixed salt: 01 02 03 04 05 06 07 08]
[encrypted content (AES-128-CBC)]
[ASCII Base64(RSA(AES password))]

Overwrite-delete for large files (over ~2.3 GB) — large files are not encrypted but overwritten entirely with 0x3F and deleted. Once over the threshold, the file is not only undecryptable but nearly impossible to recover. If no specific extension is set, Zarok appends a random four-character extension to encrypted files, complicating comparison.

Post-encryption: ransom note and malicious file spread

Zarok drops a same-named executable Zarok Ransomware.exe in each non-system drive root to raise the chance of re-execution via mis-clicks, and drops README_NOW_ZAROK.txt (opened automatically) in various directories and %AppData%, containing the payment amount, Bitcoin wallet, and Telegram contact; it also decodes an embedded Base64 image as the wallpaper. Interestingly, the text note asks for €200 while the wallpaper shows €500, suggesting the actor may be testing different amounts or has not unified the content.

It must be stressed — the note claims all data will be leaked if unpaid, but reversing confirms the sample has no file exfiltration or C2 functionality; this is merely intimidation.

Clipboard Bitcoin-address hijacking

The driveNotification class creates a hidden window and registers clipboard-update events; on update, it reads the text and uses a regex to judge whether it is a Bitcoin address. If it judges a valid BTC address, it replaces bc1-prefixed ones with bc1qrx0frdqdur0lllc6ezmv45hchdrg72ns7m6jmy and others with the legacy address 19DpJAWr6NCVT2oAnWieozQPsRK7Bj83r4. So even without file encryption, any Bitcoin transaction on the infected host risks unknowingly paying the attacker via copy-paste, extending the ransom into long-term cryptocurrency theft.

Attack infrastructure and threat-actor assessment

Three key Bitcoin wallets appear in this sample: the dedicated ransom wallet bc1qe4ccx4tdm0acl7809et4u5jk8z78x7gwj3zmx5 (no obvious on-chain receipts observed); the clipboard-swap wallet bc1qrx0frdqdur0lllc6ezmv45hchdrg72ns7m6jmy (seen in Chaos, StormKitty, Prynt Stealer, Magnus, with actual receipts); and 19DpJAWr6NCVT2oAnWieozQPsRK7Bj83r4 (common to Chaos-derived families like Rapax, Baal, Skynet, Tyson, BetterCallSaul). The note’s Telegram handle @stfuhq also appears in Nobody Ransomware. With the Cyrillic and Russian strings in the code and the language-avoidance design, it is reasonable to suspect the developer is linked to the Russian-speaking or adjacent underground scene, though more intelligence is needed to corroborate.

Relationship to Chaos and BlackSnake

• Uses the same registry key oAnWieozQPsRK7Bj83r4 as an infection marker.
• Reuses Bitcoin wallets and Telegram handles already in the Chaos ecosystem.
• Its execution flow and code structure are highly similar, with custom logic added only in the large-file strategy and clipboard-hijack module.

Zarok can therefore be seen as a new variant within the Chaos builder ecosystem rather than an independent family. In behavior, its main risk is not data leakage but: large critical files (databases, VM images, backups, media) overwritten and deleted, unrecoverable by any decryptor; built-in recovery and backup fully disabled, leaving IR very limited tools; and clipboard BTC hijacking keeping all Bitcoin transactions perpetually exposed to theft.

Defensive recommendations

Endpoint detection and response — correlate common ransomware IoCs (filenames, paths, hashes, wallets, Telegram handles) into threat intel with active blocking; build EDR/XDR rules for unexpected vssadmin/wmic shadowcopy/bcdedit/wbadmin, launching unknown .NET binaries via runas with UAC requests, large numbers of files opened/renamed/overwritten/deleted in a short window, and processes registering clipboard-update events while scanning heavily for Bitcoin-like strings.

Privilege and system hardening — limit admin-account scope, enforce application allowlisting to block unauthorized .NET execution, and close unnecessary interactive logon on production servers to reduce lateral movement.

Backup strategy and drills — adopt “multi-version, offline, off-site” backups, regularly rehearse restoring critical systems from backup, and enforce strict access control and network isolation on backup servers.

Cryptocurrency operational security — isolate large operations from the office environment (dedicated device or hardware wallet), re-verify the recipient address before transfer instead of trusting copy-paste, and include clipboard-hijack risk in training.

Intelligence sharing — report suspected Zarok/Chaos-derived activity to industry or national information-sharing mechanisms and keep watching the related wallets and Telegram handles.

Conclusion

Zarok demonstrates the maturity of the Ransomware-as-a-Service (RaaS) and builder ecosystem: attackers need no deep development skill — with Chaos or a similar builder, they can quickly produce a new-named, new-looking, but essentially similar variant. It uses ready-made infrastructure to speed deployment, pushes victims into prolonged operational downtime via restore-point deletion and large-file overwrite, and extends the ransom into long-term cryptocurrency theft via clipboard hijacking. Against this multi-stage ransomware, traditional AV alone is not enough; enterprises need to strengthen behavioral detection, backup governance, privilege management, and user education together.

Sample and references

• Original article (Medium, OIS, Traditional Chinese): 《Zarok 勒索軟體剖析：Chaos 家族變種與大型檔案破壞特性》
• MITRE ATT&CK — basis for the technique mapping