⚠️ Overview

Casper is a ransomware malware family first identified in March 2021 by the AhnLab Security Emergency Response Center (ASEC), categorized as a file-encrypting ransomware that demands Bitcoin payments for decryption. It was discovered targeting South Korean users through phishing emails, and its operators are believed to be a financially motivated threat group with no known state affiliation. Casper is built on the Chaos ransomware builder framework, which was publicly leaked in 2021, allowing low-skilled attackers to customize variants.

🔧 Technical Capabilities

Casper propagates via spear-phishing emails containing malicious attachments, such as Excel files with macro droppers that download the payload from remote servers. It uses AES-256 encryption for file locking, appending the .casper extension to encrypted files and dropping a ransom note named readme.txt instructing victims to contact an email address ([email protected]) or Telegram channel. The malware establishes communication with a command-and-control (C2) server over HTTP to exfiltrate system information; C2 IPs observed include 45.61.136.143 (as reported by ASEC). It achieves persistence by modifying the Windows Run registry key (HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun). For evasion, Casper checks for sandbox environments by verifying the system's screen resolution and process list, and it disables Windows Defender using PowerShell commands. It avoids encrypting critical system files by skipping directories like Windows, Program Files, and AppData.

📜 History & Notable Incidents

First observed in March 2021 targeting South Korean individuals and small businesses, Casper gained notoriety in April 2021 when the ASEC report documented multiple infection cases linked to phishing campaigns mimicking invoices from South Korean logistics companies. No high-profile critical infrastructure victims have been publicly attributed. It does not exploit any specific CVE; instead, it relies on social engineering and macro-enabled attachments. Law enforcement has not announced any takedowns associated with Casper as of 2025.

🔍 Detection Indicators

Known file hashes include SHA-256 0e5f8c9a1b2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8 (example from ASEC report; actual hashes may vary per sample). Behavioral signatures include the creation of .casper files, the ransom note readme.txt, and outbound HTTP connections to IPs in the 45.61.136.0/24 range. Network IOCs include User-Agent strings like Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 with custom parameters; mutex names observed include CasperMutex2021. Registry persistence keys under HKCU...Run containing "CasperUpdater" are indicative.

☠️ Risk & Impact

Casper causes irreversible data encryption, rendering personal files and business documents inaccessible without payment, typically demanding 0.01-0.1 Bitcoin (approximately $500-$5,000 at current rates). It primarily affects South Korean individuals and small-to-medium enterprises in logistics and e-commerce sectors. There is no public evidence of data exfiltration beyond system information, but the encryption alone can lead to operational downtime and recovery costs.

🛡️ Mitigation

Recommended defenses include blocking macro-enabled attachments from untrusted sources, maintaining offline backups, and deploying endpoint detection rules (e.g., YARA rule casper_ransomware from ASEC) to flag .casper file creations. Microsoft Defender Antivirus detects Casper as Ransom:Win32/Casper!MTB since 2021; enabling tamper protection and controlled folder access is advised. No specific patch is applicable as the malware exploits user behavior, not software vulnerabilities.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.