Emerged ransomware disguised as a web browser update file

1. Introduction

Financial purpose malicious wares with using various techniques including encryption for file have been being spread these days.
We name this kind of file as a Ransomware, one of computer malwares which holds a computer system, or the data it contains, hostage against its user by demanding a ransom for its restoration.

2. Spreading path and symptoms of infection

Ransomwares can be spread via downloading from relatively vulnerable web site after being tampered. Besides attachment of e-mail, instant messenger and links in SNS can be the route for being spread.

When accessing distributing site, we can see the warning sign.



Clicking "Install update for Internet Explorer" will download following ransomware installation file.

* "Internet-Explorer_update.exe" will be for Internet Explorer web browser user.
"chrome_update.exe" will be for Google chrome web browser user.

Furthermore, it will generate additional file after being infected, and set scheduled tasks for periodical performing.

* Generated file
- (Windows folder)\Tasks\(random alphabets).job

* (Windows folder) usually means C:\WINDOWS on Win95, Win98, WinME, Win2000, and WinXP on WinNT, it will be C:\WINNT. 

On rebooting or after certain time, PC will show follow screen and interfere normal using.
Main content is plagiarized as a notice of police and contains notice about obscene material and illegal download.



Because of incongruous context written in Korean, it seems like using translator. So we can expect that it might be translated various languages.



Clicking "Next" will induce making a call to this following 3 numbers and needs $0.3, A typical example of ransomware.



Additionally, this malicious file is being spread with various file name and disguised as a normal update module.



3. How to prevent

Ransomware can damage user's data and even give financial damage. With its malicious feature, various variants can be emerged. To use PC safely from security threats of these malicious attachments, we recommend following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.

INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function and runs responding system against various security threats.