12345

3/14/2011

Emerged ransomware disguised as a web browser update file

1. Introduction

Financial purpose malicious wares with using various techniques including encryption for file have been being spread these days.
We name this kind of file as a Ransomware, one of computer malwares which holds a computer system, or the data it contains, hostage against its user by demanding a ransom for its restoration.

2. Spreading path and symptoms of infection

Ransomwares can be spread via downloading from relatively vulnerable web site after being tampered. Besides attachment of e-mail, instant messenger and links in SNS can be the route for being spread.

When accessing distributing site, we can see the warning sign.



Clicking "Install update for Internet Explorer" will download following ransomware installation file.



* "Internet-Explorer_update.exe" will be for Internet Explorer web browser user.
"chrome_update.exe" will be for Google chrome web browser user.

Furthermore, it will generate additional file after being infected, and set scheduled tasks for periodical performing.

* Generated file
- (Windows folder)\Tasks\(random alphabets).job


* (Windows folder) usually means C:\WINDOWS on Win95, Win98, WinME, Win2000, and WinXP on WinNT, it will be C:\WINNT. 

On rebooting or after certain time, PC will show follow screen and interfere normal using.
Main content is plagiarized as a notice of police and contains notice about obscene material and illegal download.



Because of incongruous context written in Korean, it seems like using translator. So we can expect that it might be translated various languages.



Clicking "Next" will induce making a call to this following 3 numbers and needs $0.3, A typical example of ransomware.



Additionally, this malicious file is being spread with various file name and disguised as a normal update module.



3. How to prevent

Ransomware can damage user's data and even give financial damage. With its malicious feature, various variants can be emerged. To use PC safely from security threats of these malicious attachments, we recommend following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.

INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function and runs responding system against various security threats.

5 comments:

  1. It fundamentally includes nearly everything to keep your PC sheltered and shielded from any sort of dangers. Its infection definition is redesigned frequently, now and again a few circumstances in 60 minutes. https://how-to-remove.org/malware/browser-hijacker-removal/gotowebs-com-removal/

    ReplyDelete
  2. Great! I also encourage you to have a look at this page about iKeyMonitor features.

    ReplyDelete
  3. Nice article, I will defiantly look forward for more!NewTab TV Redirect

    ReplyDelete