Trojan:Win64/InterLock.GVA!MTB

Trojan:Win64/InterLock.GVA!MTB uses a multi-phase infection process, starting with initial compromise via social engineering vectors. The threat actors sent compromised discord invite links that redirected to an infected server. The device then encounters a rogue bot named "Safeguard" that directed them to a phishing domain, such as captchaguard[.]me for an OAuth2 authentication loop. The delivery mechanism for the payload used weaponized PowerShell scripts (stage1.ps1) that installs a malformed PyInstaller package. InterLock then gains persistence by manipulating Windows Registry RUN keys. 

The attack chain also included privilege escalation as the threat actor exploits vulnerable drivers by running ktool.exe that gives them SYSTEM-level access. For the second stage, they deployed cwiper.exe; then runs the ransomware binary. The threat actor then uses data collection scripts (lootsubmit.ps1) to capture Windows metadata that included the MAC address and location identification of the infected device which is later submitted to a pastebin[.]com link. 

Encryption operations uses hybrid cryptographic schemes combining AES-256 and RSA algorithms, appending randomized extensions to locked files. The malware incorporates multiple remote access trojans including a customized InterLock RAT variant, and other components that get command shell access and lateral movement. Evasion techniques focus on fileless runtime through PowerShell, while masquerading as legitimate processes including PuTTY and LogMeIn binaries. Post-compromise activity includes registry modification for persistence, credential harvesting, and the deployment of secondary payloads through DLL sideloading techniques. The ransomware terminates by running its internal cleanup routines that remove removes itself from the device while leaving ransom notes with Tor-based payment instructions. 

Trojan:Win64/InterLock.GVA!MTB creates the following files: 

• stage1.ps1 
• cwiper.exe 
• lootsubmit.ps1 
• ktool.exe 
• pyinstaller.exe 

Registry entries modified: 

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run 

Accesses or downloads from the following URLs: 

• pastebin[.]com 
• captchaguard[.]me