Spritecoin Ransomware  - pd6Jf1516841953 - Spritecoin Ransomware Steals Passwords & Asks Monero to Decrypt Files

A New Discovered which is Demanding the Crypto Currency to the victim’s instead of traditional and widely using payment Cryptocurrency Bitcoin.

A Monero Cryptocurrency has been created in 2014, the current price is $316 USD and it’s widely getting popular in cryptocurrency world.

Spritecoin Ransomware also Pretending as a cryptocurrency-related password store along with Monero payment and mimics as a spritecoin Cryptocurrency wallet.

It the user to create a desired password to connect with Blockchain but it doesn’t make any connection and it silently Encrypt the victim’s file.

Once all the victim’s file will be encrypted, it demands the ransom asks to pay via Monero cryptocurrency to decrypt the file.

Spritecoin Ransomware also spying to steal the Chrome stored credentials and once it finds no information then it moves ahead and checks the Firefox credentials and it is using SQLite to store the credentials that have been harvested from the browsers.

Also Read:  Ransomware Attack Response and Mitigation Checklist

How Does Spritecoin Ransomware Works

It mainly targeting users who all are interesting in cryptocurrency via forum spam and aslo it using social engineering techniques, without user interaction via .

Some time it arrived via exploit kits, malicious crafted Excel/Word/PDF macros, or JavaScript downloaders.

Attacker manly using some professonal social engineering techniques via crafted malicious email and trick users to click on it.So Spritecoin Ransomware needs some user interaction to successfully exploit Its payload.

According to Fortinet, Initially, it arrives “SpriteCoin” package (spritecoind[.]exe) and mimics as Spritecoin crypto-currency wallet, that is actually not a cryptocurrency wallet, it was created and spread for this .

Once the Ransomware successfully executed, its prompt used into a page where users urged to “Enter your desired wallet password”

- tony1 - Spritecoin Ransomware Steals Passwords & Asks Monero to Decrypt Files

Once password enter, another window shows the user that, it connected into Blockchain. but it is actually a process of the encryption process of users file.

- tony2 - Spritecoin Ransomware Steals Passwords & Asks Monero to Decrypt Files

This ransomware using onion for victims to communicate with an attacker.This allows the victim to communicate with the attacker’s website without the need for a TOR connection.

Once the encryption process will be done, its demand  0.3 Monero – which is equivalent to $10 USD. also it generates ransom note that says “Your files are encrypted”.

- tony4 - Spritecoin Ransomware Steals Passwords & Asks Monero to Decrypt Files

Also, it transferred the harvested credentials to a remote website. aslo another twist is, if the user trying to pay the ransomware it downloads another payload.

Source link


Please enter your comment!
Please enter your name here