[Trend]qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware

[igor51]

qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware

We encountered a few interesting samples of a file-encoding ransomware variant implemented entirely in VBA macros called qkG (detected by Trend Micro as RANSOM_CRYPTOQKG.A). It’s a classic macro malware infecting Microsoft Word’s Normal template (normal.dot template) upon which all new, blank Word documents are based.

Further scrutiny into qkG also shows it to be more of an experimental project or a proof of concept (PoC) rather than a malware actively used in the wild. This, however, doesn’t make qkG less of a threat.

Post from: Trendlabs Security Intelligence Blog - by Trend Micro

qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware

Source: qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware