KeyPass Ransomware  - 3jLVY1534710824 - KeyPass Ransomware Attack Around the World To Encrypt the Victims File

Newly emerging KeyPass actively spreading around the to the targetted system files and demand the ransom to the .

When compared to last year, currently ransomware outbreaks are very less, however, new ransomware attacks are kept increasing and the malware authors always trying to find the new method into infiltrate system to make a huge profit.

Main Payload dropped via trojan that is written in C++ and compiled in MS Visual Studio and the compiled data has been discovered from PE header.

Unlike other ransomware attacks, malware authors added new futures that give to take “manual control” by default.

- ma - KeyPass Ransomware Attack Around the World To Encrypt the Victims File
                                           GUI of the trojan

This capacity may be a sign that the hackers behind the Trojan mean to utilize it in manual Attacks.

KeyPass Ransomware Infection Flaw

An initial stage of propagation starts from the  installers that download the ransomware module.

once  clicks the malicious files and open then the trojan copies its executable to %LocalAppData% and delete itself from the original location, also it skips of some of the directories.

- keypass - KeyPass Ransomware Attack Around the World To Encrypt the Victims File

According to Kaspersky Researchers,  The developers of this Trojan implemented a very simplistic scheme. The malware uses the symmetric algorithm AES-256 in CFB mode with zero IV and the same 32-byte key for all files. The Trojan encrypts a maximum of 0x500000 bytes (~5 MB) of data at the beginning of each .

KeyPass connects to its command and control (C&C) to receive the encryption key and the data is transferred over plain HTTP.

After the complete execution, it encrypts all the disk files and adds the additional extension “.KEYPASS” including images, videos, doc etc.

Later it displays the ransom notes that contain the detailed description about the decryption process of the infection file

- keypass1 - KeyPass Ransomware Attack Around the World To Encrypt the Victims File
                                                           Ransomware notes

Attackers instruct victims to contact via particular email ID([email protected]) along with victims personal ID and they demand $300 for providing the decryption key.

IOC

901d893f665c6f9741aa940e5f275952 – Trojan-Ransom.Win32.Encoder.n
hxxp://cosonar[.]mcdir.ru/get[.]php





Source link

LEAVE A REPLY

Please enter your comment!
Please enter your name here