The good news is that Cyren researchers found that it’s possible to both decrypt the encrypted files, and recover those that were deleted. He added, “This ransomware is effectively cheating the cheater.” This makes encrypting files using a game hack highly opportunistic and easy to execute.” Malware posing as a hack tool is novel as it will not be validated by any app store and bypasses the normal security controls.
It is a large audience to target and an industry that is known to look for shortcuts. “Social engineering through online video games has been going on for some time. “Combining game malware with ransomware was inevitable,” Chris Morales, head of security analytics at Vectra, told Threatpost. “The next step is it will set a timed procedure to try and delete the encrypted files in the directories listed below, deleting the files every two hours in the following order: %userprofile%\Pictures %userprofile%\Desktop and %userprofile%\Documents,” the researchers wrote.Īt the same time, it starts using LimeUSB_Csharp.exe to infect USB drives if they exist. It also monitors for Taskmgr, Procmon64 and ProcessHacker, which could interrupt its processes. Once the payload is executed, it connects to a command-and-control (C2) server and disables Windows Defender and UAC through a registry tweak.
0 kommentar(er)
