ESET reported earlier this month that the Nemucod trojan is shifting away from ransomware and having victims download the ad-clicking malware Kovter instead. Now, it seems that the operators of the malware have decided to do both. Victims are now receiving ransomware as well as ad-clickers.
As before, the targeted user receives an email with an infected attachment containing an executable .js file – the downloader. After unpacking and running it, it downloads five files at once. The first two are ad-clickers which were detected by ESET as Win32/Kovter andWin32/Boaxxe.
The remaining three files have one very clear objective – to find the most valuable files on the computer and encrypt them. To run the ransomware, Nemucod installs a PHP interpreter and an additional PHP library (these two files are actually clean). Only after that a third file – detected by ESET as PHP/Filecoder.D – is downloaded and starts its malicious activities, using an encryption key hardcoded directly in the malware.
This results in files of about 120 extensions, including MS Office files, images, videos, sound files, and others, getting encrypted and getting the “.crypted” extension. After the ransomware has finished with encryption, Nemucod creates a text file with a ransom demand. In the end, the PHP interpreter, its library and the filecoder file are removed from the system.
In addition, a remotely controlled backdoor is installed. Boaxxe is able to download and execute files or install extensions to popular browsers such as Chrome and Firefox. On top of this, the trojan connects to a command and control (C&C) server enabling its operator to misuse the infected machine as a proxy server, probably as a means for click-fraud or boosting traffic for selected websites.
ESET advises users to stay safe and protect themselves from this threat through file extension blocking and identifying, so emails with .EXE, *.BAT, *.CMD, *.SCR, and *.JS attachments should be blocked. The company also advises setting systems to show the full extensions, and to use a reliable security solution.
If a malware infection has taken your PC hostage, consider following the guidelines provided in this link Virus Removal to clean it out and restore your PC to a pristine state. Protect your digital assets by leveraging the top notch instructions provided to quickly remove any kind of malware infection be it Browser Hijacker, Adware, Ransomware, Trojan, Virus.
ReplyDelete