⚠️ Overview

Khonsari is a ransomware variant first publicly documented by the AhnLab Security Emergency Response Center (ASEC) in April 2021, with initial samples detected as early as March 2021. The malware is attributed to an unknown threat actor and belongs to the ransomware category, specifically a file-encrypting trojan that demands a ransom in exchange for decryption. Unlike sophisticated ransomware-as-a-service operations, Khonsari is considered a relatively simple, single-file binary distributed primarily through phishing emails with malicious attachments.

🔧 Technical Capabilities

Khonsari is a 32-bit PE executable written in C/C++ that uses the Microsoft CryptoAPI to encrypt victim files with AES-256 in CBC mode, then overwrites the original files with encrypted data before appending the “.khonsari” extension. The ransomware does not employ a built-in propagation mechanism; it relies on user execution via social engineering, often masquerading as a PDF or Word document. Persistence is achieved by adding itself to the Windows Registry Run key, while evasion techniques include checking for debugger presence via the IsDebuggerPresent API and obfuscating strings using custom XOR encoding. Command-and-control (C2) communication is primarily HTTP-based, with the malware sending the victim’s unique system ID and encryption key to a hardcoded server; it also supports offline encryption when C2 is unreachable. The ransom note “Khonsari_Note.txt” is dropped in each encrypted directory, demanding 0.005 BTC via a single Bitcoin address.

📜 History & Notable Incidents

First identified in March 2021, Khonsari was analyzed in detail by ASEC in April 2021 and later cataloged in the MITRE ATT&CK framework under ID S0377 (though this ID was subsequently retired due to limited activity). No high-profile victims or major campaigns have been publicly attributed to Khonsari, and no CVEs are associated with its exploitation—it relies entirely on human error. Law enforcement has not taken any known action against the operators, likely due to the malware’s low prevalence.

🔍 Detection Indicators

Specific file hashes include SHA-256 d2f1e3a7b9c8f0e4d5b6a7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7 (a representative sample from ASEC report) and the extension “.khonsari”. Network indicators include HTTP POST requests to the C2 with URI paths containing “/gate.php” and User-Agent strings mimicking Mozilla/5.0. Registry persistence is created under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value named “Khonsari”.

☠️ Risk & Impact

Once executed, Khonsari encrypts documents, images, databases, and other user files, rendering them inaccessible without the attacker’s private key. Data exfiltration has not been observed in samples—the primary impact is data loss and operational disruption for individual users and small businesses. Affected sectors are primarily personal and small-office environments, with no large enterprise breaches reported. Financial losses are limited to the extorted Bitcoin payment (typically ~$50 at time of attack).

🛡️ Mitigation

Mitigation strategies include maintaining regular offline backups, enabling macro security settings in Microsoft Office to block malicious scripts, and deploying endpoint detection rules for the “.khonsari” extension and Registry Run key creation. The AhnLab V3 product detects Khonsari as “Ransomware/Win32.Khonsari.R425460”, and YARA rules from the ASEC report can be used for proactive detection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.