We name this kind of file as a Ransomware, one of computer malwares which holds a computer system, or the data it contains, hostage against its user by demanding a ransom for its restoration.
2. Spreading path and symptoms of infection
Ransomwares can be spread via downloading from relatively vulnerable web site after being tampered. Besides attachment of e-mail, instant messenger and links in SNS can be the route for being spread.
When accessing distributing site, we can see the warning sign.
Clicking "Install update for Internet Explorer" will download following ransomware installation file.
Furthermore, it will generate additional file after being infected, and set scheduled tasks for periodical performing.
On rebooting or after certain time, PC will show follow screen and interfere normal using.
Main content is plagiarized as a notice of police and contains notice about obscene material and illegal download.
Because of incongruous context written in Korean, it seems like using translator. So we can expect that it might be translated various languages.
Clicking "Next" will induce making a call to this following 3 numbers and needs $0.3, A typical example of ransomware.
Additionally, this malicious file is being spread with various file name and disguised as a normal update module.
3. How to prevent
Ransomware can damage user's data and even give financial damage. With its malicious feature, various variants can be emerged. To use PC safely from security threats of these malicious attachments, we recommend following "Security management tips" for general users.
INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function and runs responding system against various security threats.