Sad Ransomware

TL;DR

A brand new ransomware sample has been discovered, undetected by major antivirus software, which encrypts files and displays a ransom note.

Transcript

who knows tell geo wallpaper yesterday I came across a brand new ransomware sample which I hadn't seen before at the moment I believe it was detected by only seven engines right now I just uploaded it to VARs total and as you can see we have 21 out of 67 a fee company's picking it up it is however still undetected by a lot of products including Mic... Read More

Key Insights

• 👶 The new ransomware sample is currently undetected by several major antivirus products, including Microsoft's.
• 👤 The ransomware follows traditional malware behavior patterns, deleting itself after execution and encrypting the user's data.
• 👶 It creates a new executable in shared folders to spread the infection across a network.
• 💨 The ransom note includes multiple formats, such as desktop background change, HTA file, and text, providing various ways to communicate the ransom demand.
• 😒 The ransomware uses a non-onion domain for the ransom payment website, which is an unusual choice.
• 💌 The email address provided for contact is hosted on ProtonMail, a popular encrypted email service.
• 💪 The encryption used by the ransomware is AES-256, which is a strong encryption algorithm.

Questions & Answers

Q: How many antivirus engines currently detect the new ransomware sample?

At the moment, only seven antivirus engines detect the new ransomware sample. This low detection rate is concerning, as it leaves many systems vulnerable to the threat.

Q: What happens when the ransomware is executed?

After execution, the ransomware first deletes itself and then encrypts the user's data. It also creates a copy in shared folders to spread the infection to other systems on the network.

Q: How is the ransom note displayed?

The ransom note is displayed on the infected user's system, informing them that their files have been encrypted. The ransom note includes a website for ransom payment and an email address for contact.

Q: Can the encrypted files be decrypted without payment?

Based on the information provided, it is unlikely that the encrypted files can be decrypted without paying the ransom. The ransomware claims to use AES-256 encryption, which is a strong encryption algorithm.

Summary & Key Takeaways

• A new ransomware sample has been found, detected by only a few antivirus engines, including Var's Total.

• The ransomware deletes itself and creates an executable in shared folders to infect other systems.

• The ransom note is displayed, files are encrypted using AES-256, and a ransom payment website and email address are provided.