12345

3/14/2011

Emerged ransomware disguised as a web browser update file

1. Introduction

Financial purpose malicious wares with using various techniques including encryption for file have been being spread these days.
We name this kind of file as a Ransomware, one of computer malwares which holds a computer system, or the data it contains, hostage against its user by demanding a ransom for its restoration.

2. Spreading path and symptoms of infection

Ransomwares can be spread via downloading from relatively vulnerable web site after being tampered. Besides attachment of e-mail, instant messenger and links in SNS can be the route for being spread.

When accessing distributing site, we can see the warning sign.



Clicking "Install update for Internet Explorer" will download following ransomware installation file.



* "Internet-Explorer_update.exe" will be for Internet Explorer web browser user.
"chrome_update.exe" will be for Google chrome web browser user.

Furthermore, it will generate additional file after being infected, and set scheduled tasks for periodical performing.

* Generated file
- (Windows folder)\Tasks\(random alphabets).job


* (Windows folder) usually means C:\WINDOWS on Win95, Win98, WinME, Win2000, and WinXP on WinNT, it will be C:\WINNT. 

On rebooting or after certain time, PC will show follow screen and interfere normal using.
Main content is plagiarized as a notice of police and contains notice about obscene material and illegal download.



Because of incongruous context written in Korean, it seems like using translator. So we can expect that it might be translated various languages.



Clicking "Next" will induce making a call to this following 3 numbers and needs $0.3, A typical example of ransomware.



Additionally, this malicious file is being spread with various file name and disguised as a normal update module.



3. How to prevent

Ransomware can damage user's data and even give financial damage. With its malicious feature, various variants can be emerged. To use PC safely from security threats of these malicious attachments, we recommend following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.

INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function and runs responding system against various security threats.

9 comments:

  1. It fundamentally includes nearly everything to keep your PC sheltered and shielded from any sort of dangers. Its infection definition is redesigned frequently, now and again a few circumstances in 60 minutes. https://how-to-remove.org/malware/browser-hijacker-removal/gotowebs-com-removal/

    ReplyDelete
  2. Great! I also encourage you to have a look at this page about iKeyMonitor features.

    ReplyDelete
  3. Nice article, I will defiantly look forward for more!NewTab TV Redirect

    ReplyDelete
  4. This comment has been removed by the author.

    ReplyDelete
  5. Since we work with different assignment writings (you will find the full list in the order form),
    there are different writers to work on them. We will run your assignment help requirements against our panel of writing experts and find the most suitable one who will be helping with assignment of particular kind.
    https://samedayessays.net/custom-writing-service/

    ReplyDelete
  6. Welcome to the review of AllAssignmenthelp.com reviews, a writing service in Britain aimed at USA. This is best Reviews site in USA.

    ReplyDelete
  7. Insecticides may not achieve satisfactory results in the elimination of ants. These pesticides soon expire and they do not reach the cracks in the colonies of ants.
    شركة مكافحة حشرات بالجبيل
    شركة رش مبيدات بالجبيل
    شركة الانوار لمكافحة الحشرات
    شركة رش مبيدات بالمجمعة

    ReplyDelete