Ransomware and Recent Variants

Minimalist · Apr 18, 2017

Ransomware Timeline: 2010 – 2017
https://labsblog.f-secure.com/2017/04/18/ransomware-timeline-2010-2017/

Minimalist · Apr 18, 2017

Low-cost ransomware service discovered

A new ransomware as a service (RaaS) called Karmen has been discovered by security researchers at Recorded Future. This service allows anyone, including novices, to set up an account and customize their own ransomware campaign.
Click to expand...

https://threatpost.com/low-cost-ransomware-service-discovered

Minimalist · Apr 21, 2017

An untold cost of ransomware: It will change how you operate

Ransomware is unfortunately an IT reality. With the complexity and frequency of attacks, there is a good chance you or someone you know has been impacted. Many victims attacked are tempted to just pay the ransom and be done with it; a strategy that is more widely-used than you might think. Even the FBI has admitted that sometimes paying the ransom is the way to go.
Click to expand...

https://www.helpnetsecurity.com/2017/04/21/ransomware-cost/

itman · Apr 22, 2017

Threat Spotlight: Mighty Morphin Malware Purveyors: Locky Returns Via Necurs

Throughout the majority of 2016, Locky was the dominant ransomware in the threat landscape. It was an early pioneer when it came to using scripting formats Windows hosts would natively handle, like .js, .wsf, and .hta. These scripting formats acted as a vehicle to deliver the payload via email campaigns. However, late in 2016 Locky distribution declined dramatically largely due to the slowdown of Necurs that occurred at the same time.

On April 21st, Talos observed the first large scale Locky campaign in months from Necurs. This campaign leveraged techniques associated with a recent Dridex campaign and is currently being distributed in very high volumes. Talos has seen in excess of 35K emails in the last several hours associated with this newest wave of Locky. This large wave of distribution has been attributed to the Necurs botnet which, until recently, had been focused on more traditional spam such as pump-and-dump spam, Russian dating spam, and work-from-home spam.
Click to expand...

http://blog.talosintelligence.com/2017/04/locky-returns-necurs.html

Minimalist · Apr 27, 2017

Nearly 40% of Ransomware Victims Pay Up to Unlock Their Devices

According to a new research from cybersecurity firm Trustlook, it's not just businesses that are threatened by ransomware, but also random, regular Internet users. The latter, it seems, are easier targets and have fewer resources than major companies to combat criminals, which is why they are the most likely to comply with the demands of these cyber criminals.

Trustlook's report indicates that about 17% of consumers have, by this point, been infected with ransomware. 38% of all affected consumers have chosen to pay the ransom, which regularly ranges between $100 and $500, most often than not expressed in Bitcoin. On the other hand, those who have not yet been affected by ransomware present a tough stance, as only 7% say they would pay the fees.
Click to expand...

http://news.softpedia.com/news/near...s-pay-up-to-unlock-their-devices-515189.shtml

Minimalist · Apr 27, 2017

Ransomware Attacks Rise As Hackers Focus On Educational and Healthcare Institutions

Verizon recently published the 2017 edition of the annual Data Breach Incident Report (DBIR). The results are bleak, as ransomware attacks have increased by 50% during the past year.

Analyzing the report, the security experts have highlighted on two key aspects. The stats reveal that attacks on educational institutions have gone up. The other focal point is a concerning trend in the healthcare sector. According to Verizon, 68% of the breaches in healthcare facilities are internal.
Click to expand...

http://virusguides.com/ransomware-attacks-rise-hackers-focus-educational-healthcare-institutions/

ronjor · Apr 27, 2017

Ransomware attacks are taking a bigger toll on victim's wallets

By Michael Kan U.S. Correspondent, IDG News Service Apr 27, 2017
The average ransomware payment rose to $1,077, up from $294 a year earlier, Symantec said
Click to expand...

Minimalist · Apr 28, 2017

Lack of communication achilles’ heel for ransomware fighters

Collaboration is important when it comes to fighting ransomware, but the lack of communication around the issue remains a serious impediment, law enforcement says.

“If we don’t know about it and no one keeps track of it, then no one cares,” Frank McLaughlin, a detective with the Boston Police Department’s cybersecurity division said during a SOURCE Boston panel Thursday morning.
Click to expand...

https://threatpost.com/lack-of-communication-achilles-heel-for-ransomware-fighters

itman · May 1, 2017

New version of the CryptoMix Ransomware Using the Wallet Extension

A new CryptoMix, or CryptFile2, variant was released that is now using the .[payment_email].ID[VICTIM_16_CHAR_ID].WALLET extension for encrypted files. This is very annoying as it makes it more difficult for victims to easily identify what ransomware they are infected with when they perform web searches. This is because the .WALLET extension has been used by Dharma/Crysis, Sanctions, and now we have CryptoMix. Currently payment email addresses are shield0@usa.com
admin@hoist.desi, and crysis@life.com.

This variant was discovered by independent security researcher R0bert R0senb0rg and later identified as CryptoMix by MalwareHunterTeam. I decided to take a look at the sample and take a deeper dive to see what has changed since the previous Revenge variant was released.

Unfortunately, at this time there is no way to decrypt files encrypted by this Wallet for free. For those who wish to discuss this ransomware or receive support, you can always use our CryptoMix or CrypMix Ransomware Help Topic.

As a note, in this article I will be referring to this infection as the Wallet Ransomware as that will most likely be how the victim's will search for it. It is important to remember, though, that this ransomware is not a brand new infection, but rather just a new version of the CryptoMix ransomware family.
Click to expand...

https://www.bleepingcomputer.com/ne...ptomix-ransomware-using-the-wallet-extension/

Minimalist · May 2, 2017

Cerber Version 6 Shows How Far the Ransomware Has Come (and How Far it’ll Go)

A little over a year after its first variants were found in the wild, Cerber (Detected by Trend Micro as RANSOM_CERBER family) now has the reputation for being the most prolific family of ransomware in the threat landscape. Since it first emerged in Russian underground marketplaces in March, 2016, Cerber has since spawned several versions whose structure, techniques, and capabilities were regularly updated by its developers—sometimes a day apart, in the case of Cerber 4.1.5. It has become so successful that the ransomware family has reportedly eclipsed other families like Locky (RANSOM_LOCKY).
Click to expand...

http://blog.trendmicro.com/trendlabs-security-intelligence/cerber-ransomware-evolution/

itman · May 3, 2017

Minimalist said: ↑

http://blog.trendmicro.com/trendlabs-security-intelligence/cerber-ransomware-evolution/
Click to expand...

Of importance to anyone using the Win firewall or a AV product that also optionally allows for Win outbound firewall rules to employed is this "goodie" the latest Cerber variant, Cerber 6, is employing:

Cerber 6 goes beyond identifying them and can now be configured to have Windows firewall rules added in order to block the outbound traffic of all the executable binaries of firewalls, antivirus, and antispyware products installed in the system. This can possibly restrict their detection and mitigation capabilities. This is further exacerbated by how Cerber can also circumvent static machine learning detection on top of self-awareness of analysis tools and virtualized environments that allows it to evade them (by self-destructing).
Click to expand...

-EDIT- A couple of other "goodies" about Cerber 6:

The use of delayed execution allows the ransomware to elude traditional sandbox defenses that feature time-out mechanisms or which wait for the final execution of the malware.

The ransomware now uses Cryptographic Application Programming Interface (CryptoAPI) for encryption, and has a separate function that reads and encrypts the contents of the file.
Click to expand...

Also Cerber 6 can be deployed by creating a scheduled task. Makes me believe it may have "taken a page" from Trickbot's malware playbook and is creating a SID to do so. If this is indeed the case, we definitely have a major Win vulnerability in the wild.

Minimalist · May 3, 2017

New Decryption Tool Available for Cry128 Strain of CryptON Ransomware Family

The war against ransomware can claim another won battle as a new decrypter has been released for free by Emsisoft. This time, the decrypter works on the Cry128 strain from the CryptON ransomware family.
Click to expand...

http://news.softpedia.com/news/new-...ain-of-crypton-ransomware-family-515363.shtml

boredog · May 3, 2017

Minimalist said: ↑

http://news.softpedia.com/news/new-...ain-of-crypton-ransomware-family-515363.shtml
Click to expand...

To use this you need a encrypted file as well as an unencrypted one? Where are they suppose to get the unencrypted file?

itman · May 3, 2017

boredog said: ↑

To use this you need a encrypted file as well as an unencrypted one? Where are they suppose to get the unencrypted file?
Click to expand...

Detailed instructions here: https://decrypter.emsisoft.com/howtos/emsisoft_howto_cry128.pdf

itman · May 3, 2017

boredog said: ↑

To use this you need a encrypted file as well as an unencrypted one? Where are they suppose to get the unencrypted file?
Click to expand...

The assumption I believe is that somewhere you have a copy of an encrypted file stored offline that you can use. Or for an encrypted .pdf prior download for example, download it from the original source again.

Also more important is that all traces of the ransomware are removed prior to accessing any offline storage device.

Minimalist · May 3, 2017

boredog said: ↑

To use this you need a encrypted file as well as an unencrypted one? Where are they suppose to get the unencrypted file?
Click to expand...

If I wouldn't have unencrypted copy of files I would probably download some file from net and wait till malware encrypts it. I don't know if it would work but that way I could get a pair. If same encryption details were used for both encryption processes, recovery tool would get info to decrypt other files also (for which I don't have an unencrypted pair).

ronjor · May 5, 2017

'Fatboy' ransomware uses a location-based charging model

By Ian Barker
A new ransomware-as-a-service product named 'Fatboy' has been advertised on Russian language forums. What makes it different is the way it uses a sliding scale to charge its victims.
Click to expand...

Minimalist · May 6, 2017

New types of ransomware innovate to find opportunity

There is no shortage of new types of ransomware, many with unique features, and experts say it's an exercise in innovation and finding revenue opportunity.
Click to expand...

http://searchsecurity.techtarget.co...es-of-ransomware-innovate-to-find-opportunity

stapp · May 7, 2017

Yet another Emsisoft Decrypter released, this time for the ransomware Amnesia

https://decrypter.emsisoft.com/amnesia

itman · May 7, 2017

Minimalist said: ↑

http://searchsecurity.techtarget.co...es-of-ransomware-innovate-to-find-opportunity
Click to expand...

In this article is a link to another article on User Behavior Analytics that is worth a read: http://searchsecurity.techtarget.com/definition/user-behavior-analytics-UBA . Notablely the following:

Machine learning algorithms allow UBA systems to eliminate false positives and provide clearer and more accurate actionable risk intelligence.

While running user behavior analytics on just one user may not be useful to finding malicious activity, running it on a large scale would give an organization the ability to detect malware or other potential threats. UBA is therefore most useful to larger financial or manufacturing companies.
Click to expand...

Something for individuals to ponder before taking the leap into "Next Gen" anti-malware technology.

Minimalist · May 10, 2017

SLocker Android Ransomware Resurfaces in Undetectable Form

Recently though, Wandera’s mobile threat intelligence engine identified more than 400 new variations of the SLocker malware targeting business’ corporate mobile device fleets through third-party app stores. All have a very low detection rate.
Click to expand...

https://www.infosecurity-magazine.com/news/slocker-android-ransomware/

itman · May 10, 2017

RSAUtil Ransomware Distributed via RDP Attacks

The author of a newly discovered ransomware family is hacking into remote desktop services to upload the malware alongside a bunch of other tools.

Dubbed RSAUtil, the ransomware is written in Delphi and appends the .helppme@india.com.ID83994902 extension to the encrypted files, Emsisoft malware researcher xXToffeeXx revealed on Twitter. The malware also drops a How_return_files.txt ransom note in every folder.

In addition to the malware itself, the package of files that the malware’s developer drops after hacking into remote desktop services includes a variety of tools and a config file meant to determine how the ransomware executes, BleepingComputer’s Lawrence Abrams notes.

The package is meant to prepare the machine for the installation of RSAUtil ransomware. A CMD file cleans up traces of how the machine was compromised by clearing event logs; two files prevent the computer from going to sleep or hibernating, so that the connection remains active; an image file is supposedly used as desktop background; and a bat file is used to configure various remote desktop services options.

There is also a configuration file the ransomware uses when performing the encryption process, containing directives that check whether the computer has been encrypted already, what ID the malware should use, what email to use, the ransom note name, the encrypted file extension, and the public encryption key to use to encrypt files.

RSAUtil ransomware is included in the package under the name of svchosts.exe. It scans the computer’s folders, along with mapped network drives and unmapped network shares, and encrypts user’s files. It also places a ransom note in every folder where a file has been encrypted.

The malware doesn’t target a specific list of file types to encrypt, which means that many of the executables on the machine end up being encrypted as well. The specific sample researchers analyzed in this case was appending the .helppme@india.com.ID83624883 extension to the encrypted files.
Click to expand...

http://www.securityweek.com/rsautil-ransomware-distributed-rdp-attacks

Minimalist · May 11, 2017

Jaff ransomware: The new Locky?

Ransomware continues to be a growing security threat, with new families cropping up every week. Emsisoft researchers are often involved in the discovery and analysis of new threats, and this ransomware is no different. Originally spotted earlier today, Jaff ransomware caught our attention due to it being spread via the Necurs botnet, which before spread ransomware such as Locky, and already having a large number of submissions to ID-Ransomware.
Click to expand...

http://blog.emsisoft.com/2017/05/11/jaff-ransomware-the-new-locky/

ronjor · May 13, 2017

Indicators Associated With WannaCry Ransomware

Original release date: May 12, 2017 | Last revised: May 13, 2017
Systems Affected
Microsoft Windows operating systems
The latest version of this ransomware variant, known as WannaCry, WCry, or Wanna Decryptor, was discovered the morning of May 12, 2017, by an independent security researcher and has spread rapidly over several hours, with initial reports beginning around 4:00 AM EDT, May 12, 2017. Open-source reporting indicates a requested ransom of .1781 bitcoins, roughly $300 U.S.
This Alert is the result of efforts between the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) and the Federal Bureau of Investigation (FBI) to highlight known cyber threats. DHS and the FBI continue to pursue related information of threats to federal, state, and local government systems and as such, further releases of technical information may be forthcoming.

itman · May 16, 2017

BTCWare Ransomware Master Key Released, Free Decrypter Available

Users that have had their files encrypted via older versions of the BTCWare ransomware can recover their files for free after security researchers created a decrypter for this ransomware family. Work on this decrypter started at the end of April.

Following the release of an initial version of th BTCWare Decrypter at the start of the month, a user released the master decryption key for the BTCWare ransomware on the BleepingComputer forums. While we don't know if this user — calling himself checker123 — is the author of the BTCWare ransomware or a member of a competing ransomware squad sabotaging their competition, we're happy either way. We suspect that checker123 is the ransomware's author, even if he never responded to our request for comment.
Click to expand...

https://www.bleepingcomputer.com/ne...master-key-released-free-decrypter-available/

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

boredog Registered Member

itman Registered Member

itman Registered Member

Minimalist Registered Member

ronjor Global Moderator

Minimalist Registered Member

stapp Global Moderator

itman Registered Member

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

ronjor Global Moderator

itman Registered Member

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

boredog Registered Member

itman Registered Member

itman Registered Member

Minimalist Registered Member

ronjor Global Moderator

Minimalist Registered Member

stapp Global Moderator

itman Registered Member

Minimalist Registered Member

itman Registered Member

Minimalist Registered Member

ronjor Global Moderator

itman Registered Member

Useful Searches