live casino online

This week the conversation is still about the two ransomware responsible for the widespread chaos that affected organizations across the globe¡ªWannaCry and Petya. , but there were recent outbreaks in countries across and in . Meanwhile, the repercussions of are still being felt. Experts are dissecting the details and trying to find the motivation behind this attack, as well as .

Other notable ransomware of the week

The downloader hashes for Karo ransomware (detected by live casino online as RANSOM_KARO.A) were actually included in a Github repository for Petya-related IOCs, but Karo is a unique threat on its own. It is a MSIL-compiled (which needs a .NET framework in order to work) and obfuscated file that typically arrives in a macro-enabled document that uses a Powershell downloader code. This , and we¡¯ve previously discussed why more and more attackers are abusing Powershell.

Using the de4dot tool, which is an open source .NET deobfuscator and unpacker, we also found that it has anti-sandbox features:

Figure 1. Snippet of code from Karo

There are a few other notable ransomware to come out over the past week. Recently the (detected as RANSOM_SAMAS) has been more active. Reports show that , as much as 12 BTC¡ªroughly US$31,600¡ªto decrypt multiple devices.

ViACrypt (detected by live casino online as RANSOM_ VIACRYPT) is a newer, potentially harmful ransomware that uses RSA-1024 algorithm to encrypt files and has a Latvian ransom note. Meanwhile, a Hidden Tear variant (detected by live casino online as RANSOM_HIDDENTEARBATTLEFIELD) is masquerading as an installer for the first-person shooter game Battlefield to trick gamers into installing it.

Figure 2. ViACrypt ransom note

The ransomware Gank (detected by live casino online as RANSOM_GANK), which appends the extension .ganklocked onto files it encrypts, is also notable. There is also the recently discovered ABCScreenlocker (detected by live casino online as RANSOM_ABCSCREENLOCKER), which simply locks the user out of his device.

Figure 3. ABCScreenlocker image

At the heels of these outbreaks, Microsoft released its contribution to protecting users from ransomware. Their recent Windows 10 Insider Preview Build introduces a new feature that ¡°monitors the changes that apps make to files in certain protected folders. If an app attempts to make a change to these files, and the app is blacklisted by the feature, you¡¯ll get a notification about the attempt.¡± Users can add certain folders that they want to protect, and also allow specific apps through the feature.

Enterprises and all users should use best practices and be proactive in protecting systems against ransomware.

Ransomware Solutions