Attention! All data on your hardrive is encrypted

From Botnets.fr
Jump to navigation Jump to search

(Publication) Link to the old Wiki page : [1] / Google search: [2]

Attention! All data on your hardrive is encrypted
Botnet Matsnu
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date 2013 / 2013-01-30
Editor/Conference AVG
Link http://blogs.avg.com/news-threats/attention-data-hardrive-encrypted (Archive copy)
Author Tomas Prochazka, Michal Cebak
Type

Abstract

We have seen various mutations of the well known “police ransomware” Trojan throughout the year. Despite the threatening and convincing message it carries, most people probably choose to avoid the “fine” by simply removing the malware. Well, the following ransomware is little bit different.

After the sample is executed and initial emulators and virtual machine detections are passed, the process spawns either ctfmon.exe or svchost.exe (randomly chosen) where it injects its own code. This injected system process then executes the copy of the sample from %TEMP% folder, which creates another ctfmon.exe or svchost.exe child process with injected code and finally starts some interesting actions.

Bibtex

 @misc{Prochazka2013BFR1289,
   editor = {AVG},
   author = {Tomas Prochazka, Michal Cebak},
   title = {Attention! All data on your hardrive is encrypted},
   date = {30},
   month = Jan,
   year = {2013},
   howpublished = {\url{http://blogs.avg.com/news-threats/attention-data-hardrive-encrypted}},
 }