Ransomware and Recent Variants

Minimalist · Feb 17, 2018

Researchers spotted a new malware in the wild, the Saturn Ransomware

Researchers at the MalwareHunterTeam spotted a new strain of ransomware called Saturn Ransomware, the name derives from the .saturn extension it appends to the name of the encrypted files.
Click to expand...

http://securityaffairs.co/wordpress/69183/malware/saturn-ransomware.html

stapp · Feb 22, 2018

The Annabelle Ransomware Is a Horrific Mess

While most ransomware is created to actually generate revenue, some developers create them to show off their "skills". Such is the case with a new ransomware based off of the horror movie franchise Annabelle.
Click to expand...

https://www.bleepingcomputer.com/news/security/the-annabelle-ransomware-is-a-horrific-mess/

itman · Feb 23, 2018

SamSam Ransomware Hits Colorado DOT, Agency Shuts Down 2,000 Computers

The Colorado Department of Transportation (DOT) has shut down over 2,000 computers after some systems got infected with the SamSam ransomware on Wednesday, February 21.

The agency's IT staff is working with its antivirus provider McAfee to remediate affected workstations and safeguard other endpoints before before reintroducing PCs into its network.

DOT officials told local press [1, 2] that crucial systems were not affected, such as those managing road surveillance cameras, traffic alerts, message boards, and others. The agency's Twitter feed continued to show traffic alerts after the agency shut down much of its employees' IT network.
Click to expand...

https://www.bleepingcomputer.com/ne...lorado-dot-agency-shuts-down-2-000-computers/

Minimalist · Feb 24, 2018

Data Keeper Ransomware Makes First Victims Two Days After Release on Dark Web RaaS

Two days after crooks started advertising the Data Keeper Ransomware-as-a-Service (RaaS) on the Dark Web, ransomware strains generated on this portal have already been spotted in the wild, infecting the computers of real-world users.

Spotted earlier this week by Bleeping Computer, Data Keeper is the third ransomware strain offered as a RaaS offering this year, after Saturn and GandCrab.
Click to expand...

https://www.bleepingcomputer.com/ne...tims-two-days-after-release-on-dark-web-raas/

FanJ · Mar 6, 2018

stapp said: ↑

The Annabelle Ransomware Is a Horrific Mess

https://www.bleepingcomputer.com/news/security/the-annabelle-ransomware-is-a-horrific-mess/
Click to expand...

Recently Bitdefender has also released a decryptor for the Annabelle Ransomware.
https://labs.bitdefender.com/2018/03/annabelle-ransomware-decryption-tool/

I'm not sure how much it differs from the BleepingComputer and MalwareHunterTeam tool.
As far as I can tell from the Bitdefender site, you have to recover the MBR but it doesn't give guidelines for that.
The BleepingComputer article points to RKill for replacing the MBR.

The Bitdefender decryptor is also listed at the No More Ransom project:
https://www.nomoreransom.org

ronjor · Mar 6, 2018

Second Ransomware Round Hits Colorado DOT

Dark Reading Staff 3/6/2018
A variant of SamSam sends CDOT employees back to pen and paper with two attack waves in two weeks.
Click to expand...

Peter2150 · Mar 6, 2018

Not a very good recommendation for McAfee.

Minimalist · Mar 7, 2018

Trends 2018: The ransomware revolution

This is actually where I came in, nearly 30 years ago. The first malware outbreak for which I provided consultancy was Dr. Popp’s extraordinary AIDS Trojan, which rendered a victim’s data inaccessible until a ‘software lease renewal’ payment was made. And for a long time afterwards, there was not much else that could be called ransomware, unless you count threats made against organizations of persistent DDoS (Distributed Denial of Service) attacks.
Click to expand...

https://www.welivesecurity.com/2018/03/07/ransomware-revolution/

guest · Mar 16, 2018

Zenis Ransomware Encrypts Your Data & Deletes Your Backups
March 16, 2018
https://www.bleepingcomputer.com/ne...-encrypts-your-data-and-deletes-your-backups/

What is most disturbing about Zenis is that it not encrypts your files, but also purposely deletes your backups.
[...] After that is completed it will execute the following commands to delete the shadow volume copies, disable startup repair, and clear event logs:
cmd.exe /C vssadmin.exe delete shadows /all /Quiet
cmd.exe /C WMIC.exe shadowcopy delete
cmd.exe /C Bcdedit.exe /set {default} recoveryenabled no
cmd.exe /C Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
cmd.exe /C wevtutil.exe cl Application
cmd.exe /C wevtutil.exe cl Security
cmd.exe /C wevtutil.exe cl System
Click to expand...

How to protect yourself from the Zenis Ransomware
In order to protect yourself from ransomware in general, it is important that you use good computing habits and security software. First and foremost, you should always have a reliable and tested backup of your data that can be restored in the case of an emergency, such as a ransomware attack.
[...]
You should also have security software that incorporates behavioral detections to combat ransomware and not just signature detections or heuristics. [...]
Click to expand...

guest · Mar 21, 2018

New R2D2 Technique Protects Files Against Wiper Malware
March 21, 2018
https://www.bleepingcomputer.com/ne...chnique-protects-files-against-wiper-malware/

Purdue University scientists have developed a data protection technique called Reactive Redundancy for Data Destruction (R2D2) that can protect data sitting inside a virtual machine from modern data-wiping malware and even some secure file deletion methods.

R2D2 was designed with virtual machines in mind, and can't function on regular operating systems. [...]
R2D2 uses the VMI interface to intercept file open and write operations on the protected OS (the Guest OS on a virtual machine). [...] will look for operations that attempt to rewrite the file with random data or with repetitive patterns of code. R2D2 supports 13 known "secure delete" methods that apps and malware are known to use.

[...] "Conceptually, it should also port to Linux, Mac OS, and other systems."
Click to expand...

guest · Mar 23, 2018

The AVCrypt Ransomware Tries To Uninstall Your AV Software
March 23, 2018
https://www.bleepingcomputer.com/ne...nsomware-tries-to-uninstall-your-av-software/

A new ransomware named AVCrypt has been discovered that tries to uninstall existing security software before it encrypts a computer. Furthermore, as it removes numerous services, including Windows Update, and provides no contact information, this ransomware may be a wiper.

[...] it will attempt to remove installed security software from the victim's computer. It does this in two ways; by specifically targeting Windows Defender and Malwarebytes and by querying for installed AV software and then attempting to remove them. [...] It then queries to see what AV software is registered with Windows Security Center and attempts to delete it via WMIC.
At this point, it is not clear whether AVCrypt is an in development ransomware or a wiper as there are characteristics that can lead to either categorization.
Click to expand...

guest · Mar 24, 2018

Rapid 2.0 Ransomware Released, Will Not Encrypt Data on PCs with Russian Locale
March 23, 2018
https://www.bleepingcomputer.com/ne...-not-encrypt-data-on-pcs-with-russian-locale/

The biggest is the addition of a code routine that detects the user's PC locale settings before launching encryption operations. If the user has locale settings set to Russian, the ransomware will not encrypt files.

Second, the ransomware now adds a randomly generated string as the file extension at the end of encrypted files. Version 1.0 used ".rapid", which allowed victims to easily detect what ransomware strain had infected their PCs.

Bleeping Computer is not aware of any attempts to mass-distribute this threat at the time of writing, but the Rapid crew were quite successful at distributing v1.0, so they do have the channels in place to switch to mass-distributing v2.0 if they wish to.
Click to expand...

guest · Mar 24, 2018

The Week in Ransomware - March 23rd 2018 - Govt Infections, Zenis, and More
March 23, 2018
https://www.bleepingcomputer.com/ne...rch-23rd-2018-govt-infections-zenis-and-more/

This week was definitely a lot busier than the previous one. During the past two weeks we have had some interesting ransomware released such as Zenis, which deletes files associated with backups, and AVCrypt that tries to uninstall your security software. We also had a bunch of organizations, including local governments, affected by ransomware infections, which were most likely the SamSam variants.

Ransomware may seem like it's dying down, but as the stories continue to come out about large organizations being infected, it is still incredibly important to make sure you have good backups and to not open unknown attachments. Be smart and stay safe!
[...]
Click to expand...

guest · Mar 24, 2018

The DiskWriter or UselessDisk BootLocker May Be A Wiper
March 24, 2018
https://www.bleepingcomputer.com/ne...ter-or-uselessdisk-bootlocker-may-be-a-wiper/

A new MBR bootlocker called DiskWriter, or UselessDisk, has been discovered that overwrites the MBR of a victim's computer and then displays a ransom screen on reboot instead of booting into Windows. This ransom note asks for $300 in bitcoins in order to gain access to Windows again.

When this infection is executed it will replace the MBR with its own bootloader and then reboots the computer using the "shutdown -r -t 0" command. Once the computer is rebooted, it will display the ransom screen shown above.

I was not able to remove the bootlocker by simply fixing the Master Boot Record (MBR), and after fixing the MBR, the machine was displaying an invalid partition table error. [...]
Click to expand...

EASTER · Mar 24, 2018

Not at all a good day to find something that devious made a visit into a system.

Peter2150 · Mar 24, 2018

Restoring an image should be an easy fix

itman · Mar 25, 2018

mood said: ↑

The DiskWriter or UselessDisk BootLocker May Be A Wiper
Click to expand...

Of note about this bugger is none of the AI engines on VT are detecting it. This also explains why Windows Defender also isn't. Hey, but people believe signature detection is useless - right? No, wrong.

cruelsister · Mar 25, 2018

Typical MBR locker. Anything that will stop the mechanism of the Petya's will squash this one.The only mystery here is why anyone would waste the time to code it (Entrance Exam to Blackhat U?).

itman · Mar 25, 2018

Unlike Petya, this malware is a diskwiper; not ransomware. The ransomware screen is totally bogus. Per the bleepingcomputer.com article, this bugger also wipes the MFT. So there is no way to recover your files.

cruelsister · Mar 25, 2018

What I meant was that the products that had the anti-MBR trasher in place will stop this one quite nicely.

Peter2150 · Mar 25, 2018

itman said: ↑

Unlike Petya, this malware is a diskwiper; not ransomware. The ransomware screen is totally bogus. Per the bleepingcomputer.com article, this bugger also wipes the MFT. So there is no way to recover your files.
Click to expand...

Hi itman

Sure there is, just restore an image.

cruelsister · Mar 25, 2018

About the only thing to do would be a Restore, but God Forbid if folk are using security solutions that would allow it in the first place.

The malware itself is nothing special; Petya (Green flavour) and Satana also messed with the MFT, and the NotPetya variant was also called a wiper. But any of these actions needs direct disk access to work, so the generic block to this process (seen in about all anti-ransomware products and any AV worth using) stops this malware.

Peter2150 · Mar 25, 2018

Hi Cruelsister

You are so right. Anything that detects ransomware at work means you are already infected. People just don't get that.

Minimalist · Mar 29, 2018

Organizations blame legacy antivirus protection for failed ransomware prevention

More than half (53 percent) of U.S. organizations that were infected with ransomware blamed legacy antivirus protection for failing to prevent the attack, according to SentinelOne. Nearly 7 out of 10 of these companies have replaced legacy AV with next-gen endpoint protection to prevent future ransomware infections.
Click to expand...

https://www.helpnetsecurity.com/2018/03/29/failed-ransomware-prevention/

guest · Mar 29, 2018

Power Company in India Hacked and Billing Data Ransomed for 10 Million Rupees
March 29, 2018
https://www.bleepingcomputer.com/ne...-billing-data-ransomed-for-10-million-rupees/

Last week hackers gained access to the computer systems of the Uttar Haryana Bijli Vitran Nigam (UHBVN) power company in India and stole the billing data of their customers. In order to get the data back, the attackers are demanding 1 RS Core, or 10 million Rupess, for the stolen data. This is equivalent to approximately $150,000 USD.

The data is purportedly being recovered by inputting from logbooks and other sources. The loss of this billing data means that the power company would be unable to send out accurate billing to their customers for current consumption as well any that were previously owed.

[...] They further stated that "there is no loss of billing data and the billing consumers would not be affected".
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

stapp Global Moderator

itman Registered Member

Minimalist Registered Member

FanJ Updates Team

ronjor Global Moderator

Peter2150 Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

Peter2150 Global Moderator

itman Registered Member

cruelsister Registered Member

itman Registered Member

cruelsister Registered Member

Peter2150 Global Moderator

cruelsister Registered Member

Peter2150 Global Moderator

Minimalist Registered Member

guest Guest

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

stapp Global Moderator

itman Registered Member

Minimalist Registered Member

FanJ Updates Team

ronjor Global Moderator

Peter2150 Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

Peter2150 Global Moderator

itman Registered Member

cruelsister Registered Member

itman Registered Member

cruelsister Registered Member

Peter2150 Global Moderator

cruelsister Registered Member

Peter2150 Global Moderator

Minimalist Registered Member

guest Guest

Useful Searches