http___free-antimalware.com_ranscam-ransomware_.xml
http___free-antimalware.com_hr_ranscam-ransomware__1.xml
1.1 1.2 1.3 1.4 1.5 1.6 2.1 2.2 2.3 2.4 3.1 3.2 4.1 4.2 4.3 4.4 4.5 5.1 5.2 5.3 6.1 7.1 7.2 7.3 8.1 8.2 8.3 9.1 9.2 10.1 11.1 12.1 13.1 14.1 15.1 15.2 15.3 16.1 16.2 17.1 17.2 17.3 18.1 18.2 18.3 18.4 19.1 19.2
What do you know about Cryptor viruses and about Ranscam in our case? The developers of Cryptor virus are now everywhere. Programs that encrypt user files and then demand a ransom for the decryption of the data bring a lot of money for their creators. Among this kind of software is a truly brilliant program. In many cases, developers of such malicious programs perform a promise: if the user pays, he receives the key to decrypt the files. But it is not always – sometimes the key after the payment, and does not come. It happens so that there is not only a key, but also files. Ranscam – our today target to describe. Virus pretends that the files are encrypted, but in fact all that the user sees on the screen – the command line with the list of deleted files. Once files are deleted, the program displays a popup window with the requirement to pay money for obtaining the encryption key. In the resulting window, the user sees the information message that all files are moved to a hidden partition and encrypted, blocked all important programs, the computer does not operate normally. It also indicates that during the payment in Bitcoins everything back in its place – the user will get their files back. Just below the window is placed in the field where you want to enter their data after making the payment. The malware supposedly should “check” payment information of the victim. At the same time they say that pressing the button without making a payment is fraught with complete removal of all files. All that makes this software – performs an HTTP GET request for PNG images that show the user verification process. In fact, the program does not check anything. In addition, payment will not help – all files are deleted by Ranscam on the infected PC. The creator of malware tries to trick the victim, so get victim money. The software itself is quite simple – it is clearly on the job is not too skilled attackers. How Ranscam works? On the user’s computer, the virus enters a .NET executable file. The file is signed by a digital certificate issued by reca.net. Date of issue of the certificate – July 6, 2016. When the victim opens the file, the software performs several actions. First, the program copies itself to the %APPDATA%\, as well as registers in the startup. In addition, it is unpacked in the %TEMP%. The program creates and runs the executable file, which is a number of folders in the victim’s system, and pretends to “encrypt” the files. In fact, it is permanently deleted. The malware in this case fully justifies its name, as also performs a number of actions, kill the user’s system: - Deleting all files on Windows, responsible for data backup (System Restore); - Deletes shadow copies; - It removes a number of registry keys responsible for starting the system in Safe Mode. After all this, the system requests a JPEG file to demonstrate the message of the need to make the payment for the decryption of files. Once all this is done, the script turns off the computer. All the steps described above, will be executed every time you turn on your PC. And every time the malware deletes all new and new files and displays a message about the need to pay Here is a list of files that are loaded when the Ranscam a malicious server. He did not even bother to obfuscate data. Information Security Experts studying malware, sent to the specified address in the message the virus e-mail. “Victim” asked for help from the creator of the virus, telling him that she could not perform correctly transaction Bitcoin. Almost immediately after the request came the answer. So far, this malware is not too common. Ranscam can be one of the first malware, whose creators did not want to do extra work, and only want money. Why create a complex Cryptor virus, spend time and money to create it, if it can be masked by normal virus that deletes files and requires the money? The question is rhetorical. By the way GridinSoft firm creates new Anti-Ransomware tool, it’s free to try now. It’s only a Beta, so you can test it now, and leave your thoughts in the comments about it.
1.1 1.2 1.3 1.4 1.5 1.6 2.1 2.2 2.3 2.4 3.1 3.2 4.1 4.2 4.3 4.4 4.5 5.1 5.2 5.3 6.1 7.1 7.2 7.3 8.1 8.2 8.3 9.1 9.2 10.1 11.1 12.1 13.1 14.1 15.1 15.2 15.3 16.1 16.2 17.1 17.2 17.3 18.1 18.2 18.3 18.4 19.1 19.2
Što znate o Cryptor virusa i oko Ranscam u našem slučaju? The developers of Cryptor virus are now everywhere. Programi koji šifriranje korisničke datoteke, a zatim zahtijevaju otkupninu za dešifriranje podataka donijeti puno novca za svoje kreatore. Among this kind of software is a truly brilliant program. In many cases, programeri takvih malicioznih programa izvesti obećanje: ako korisnik plaća, prima ključ za dekriptiranje datoteka. Ali to nije uvijek – Ponekad je ključ nakon uplate, i ne dolazi. To se događa tako da ne postoji samo ključ, ali i datoteke. Ranscam – naš današnji cilj, a to opisati. Virus pretends that the files are encrypted, ali u stvari, sve što korisnik vidi na zaslonu – naredbenog retka s popisa izbrisanih datoteka. Nakon što su datoteke izbrisane, program prikazuje popup prozor sa zahtjevom da plati novac za dobivanje ključ za šifriranje. U prozoru, korisnik vidi informacijsku poruku da su sve datoteke preselio na skrivenoj particiji i šifrirane, blokira sve važne programe, računalo ne radi normalno. To također pokazuje da je tijekom plaćanje u Bitcoins sve natrag na svoje mjesto – korisnik će dobiti svoje datoteke natrag. Odmah ispod prozora nalazi se u području gdje želite da unesete svoje podatke nakon uplate. Malware je navodno trebao “provjeriti” podaci o plaćanju žrtve. U isto vrijeme kažu da pritiskom na gumb bez plaćanja je ispunjen s potpunim uklanjanjem svih datoteka. Sve što čini ovaj softver – obavlja HTTP GET zahtjeva za PNG slike koje prikazuju postupak potvrde korisničkog. U stvari, program ne provjerava ništa. U dodatku, Plaćanje neće pomoći – sve datoteke su izbrisani od strane Ranscam on the infected PC. Tvorac zlonamjernih programa pokušava namamiti žrtvu, so get victim money. Sam program je vrlo jednostavan – jasno je da je na poslu nije previše vješti napadači. How Ranscam works? Na korisnikovom računalu, virus ulazi NET izvršnu datoteku. Datoteka je potpisao digitalnog certifikata izdanog od strane reca.net. Datum izdavanja potvrde – srpanj 6, 2016. Kada žrtva otvara datoteku, softver obavlja nekoliko radnji. Prvi, programska kopije sebe u %PODACI APLIKACIJE%, kao i registre u pokretanju. U dodatku, je nespreman u %TEMP%. Program kreira i vodi izvršnu datoteku, što je broj mapa na žrtve sustava, i pretvara se da “šifriranje” datoteke. U stvari, trajno se briše. Malware je u ovom slučaju u potpunosti opravdava svoje ime, kao što je također obavlja niz akcija, ubiti na korisnikov sustav: - Brisanje svih datoteka na Windows, odgovoran je za backup podataka (Vraćanje sustava); - Briše shadow kopije; - To uklanja niz ključeva registra odgovorno za pokretanje sustava u sigurnom načinu rada. Nakon svega toga, sustav zatraži JPEG datoteku prikazati poruku o potrebi da se izvrši uplatu za dešifriranje datoteka. Nakon što je sve to učinjeno, skripta isključuje računalo. Svi koraci gore opisano, izvršit će se svaki put kad uključite računalo. I svaki put kad se malware briše sve nove i nove datoteke i prikazuje poruku o potrebi da se plati Ovdje je popis datoteka koje se učitava kada Ranscam zlonamjerni poslužitelj. Nije čak ni pomutiti podataka. Podaci sigurnosni stručnjaci koji proučavaju malware, slati na navedenu adresu u poruci virus e-mail. “Žrtva” zatražio pomoć od tvorca virusa, govoreći mu da ne može obavljati ispravno transakciju Bitcoin. Gotovo odmah nakon što je zahtjev došao odgovor. dosada, ovaj malware nije previše čest. Ranscam može biti jedan od prvih zlonamjernih programa, čiji kreatori nisu htjeli učiniti dodatni posao, a samo žele novac. Why create a complex Cryptor virus, potrošiti vrijeme i novac da ga stvoriti, ako se može prikriti normalan virus koji briše datoteke i zahtijeva novac? Pitanje je retoričko. By the way GridinSoft Tvrtka stvara nova Anti-Ransomware alat, to je besplatno za probu. It’s only a Beta, tako da možete ga testirati sada, and leave your thoughts in the comments about it.