Fraudulent UBP Asset Trading App Used to Deliver KRSID Ransomware
Summary
AhnLab reports that a fraudulent private trading app, UBP Asset, was modified to download and run KRSID ransomware through its update process, putting users’ files at risk of encryption.
Key points
- AhnLab found that the UBP Asset private home trading system was used to distribute ransomware, following earlier reports of fraudulent investment schemes using the app.
- The HTS updater runs UBPPatch.Psh, which downloads an update configuration file; analysis of AhnLab logs indicates it was used to install HTSPnew.Exe.
- The latest UBP.Dll included a command to execute the ransomware, suggesting the threat actor modified both the update configuration and the HTS component.
- AhnLab calls the Rust-written ransomware KRSID, after its .Krsid file extension. It uses AES-256 and RSA-2048 encryption and leaves a Korean ransom note directing victims to Telegram.
- By default, KRSID encrypts files across the drive, but supports options to target a specific path, process files in batches, pause between batches, or run without encrypting.
- AhnLab advises users to install trading software only from regulated financial institutions’ official websites and keep security software updated.
Article Details
- Attack Vectors
- A private HTS program, UBP Asset, was used to deliver ransomware through its update mechanism: UBPPatch.Psh downloaded an update configuration that directed installation of HTSPnew.Exe.
- The article reports that threat actors uploaded ransomware to the HTS server, modified the update configuration, and added functionality to UBP.Dll to execute the ransomware.
- The ransomware was distributed to victims recruited through fraudulent investment schemes using messaging-app group chats.
- Defensive Notes
- Install HTS software provided by regulated financial institutions through their official websites; legitimate financial institutions do not distribute private HTS software through messaging apps or similar channels.
- Patch installed software to the latest version and update V3 to the latest version.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | phf-ubp[.]com | HTS server domain listed as a threat indicator and associated with ransomware delivery. |
| MD5 | 6d2cd65dbd0df30404b08ff007359e54 | MD5 hash listed in the article's threat indicators. |
| MD5 | a9cce44c4d42b07f114dd2b340f0046a | MD5 hash listed in the article's threat indicators. |
| MD5 | f86b2ece324cfd36e832a3b48cc3719b | MD5 hash listed in the article's threat indicators. |
| URL | hxxps[:]//phf-ubp[.]com/UBPA/_hts_tv/user | HTS server URL listed as a threat indicator; the article describes the server as delivering ransomware through the HTS update process. |
MITRE ATT&CK
T1105 · Ingress Tool TransferUBPPatch.Psh downloaded Update.Lst from the HTS server, and the update process installed the ransomware.T1204.002 · Malicious FileClicking the desktop shortcut ran UBPUpdater.Exe, initiating the HTS update chain that installed the ransomware.T1486 · Data Encrypted for ImpactKRSID ransomware encrypted files on the victim's drive.
Malware
Vendors
Products
HPlusASEC disclosed cases in 2023 and 2024 where an unauthorized HTS named “HPlus” distributed the Quasar RAT.UBP AssetThe HTS program used to distribute the ransomware is called “UBP Asset” and has long been exploited in online investment scams.V3In addition, they should take care to patch installed software to the latest version to prevent attacks exploiting vulnerabilities and update V3 to the latest version to block Malware infections in advance.