[MMPC]Ransomware: Playing on your fears

[igor51]

Ransomware: Playing on your fears

<p>The last two years have seen an increase in malware which takes control of, and holds hostage an infected machine, locking the user out until a payment of some form can be extorted. This threat type is also known as 'ransomware'.</p>
<p>Various tactics have been used by the malware writers in an attempt to intimidate users into paying a ransom in order to get back control of an infected machine. We wrote a blog post last December that describes malware extortion tactics, <a href="http://blogs.technet.com/b/mmpc/archive/2011/12/19/disorderly-conduct-localized-malware-impersonates-the-police.aspx">here</a>. <span id="ms-rterangecursor-end"></span></p>
<p>Scare tactics include displaying fake Windows activation warnings: :&nbsp;</p>
<p><a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/5826.031612_5F00_0456_5F00_RansomwareP1.png"><img style="border: 0px;" alt="Trojan:Win32/Serubsit.A" src="http://blogs.technet.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/5826.031612_5F00_0456_5F00_RansomwareP1.png" /></a></p>
<p>Figure 1: Ransom message displayed by <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Serubsit.A">Trojan:Win32/Serubsit.A</a></p>
<p>to other scare tactics:&nbsp;</p>
<p><a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/1030.031612_5F00_0456_5F00_RansomwareP2.png"><img style="border: 0px;" alt="Trojan:Win32/Serubsit.A" src="http://blogs.technet.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/1030.031612_5F00_0456_5F00_RansomwareP2.png" /></a></p>
<p>Figure 2: Ransom message displayed by <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Serubsit.A">Trojan:Win32/Serubsit.A</a></p>
<p>The most recent of these comes in the form of the following variant we detect as <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fRansirac.G">Trojan:Win32/Ransirac.G</a> (280bb31602a5dcb3674c7718f947ee0f4e44784f). In this case, an infected user is accused of illegally downloading music.</p>
<p><a href="http://blogs.technet.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/7183.031612_5F00_0456_5F00_RansomwareP3.png"><img style="border: 0px;" alt="Trojan:Win32/Ransirac.G" src="http://blogs.technet.com/resized-image.ashx/__size/550x0/__key/communityserver-blogs-components-weblogfiles/00-00-00-62-58/7183.031612_5F00_0456_5F00_RansomwareP3.png" /></a></p>
<p>Figure 3: Ransom message displayed by <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fRansirac.G">Trojan:Win32/Ransirac.G</a></p>
<p>The malware writers attempt to add an air of legitimacy to their creation by using the HTML style sheets and image content for the actual organization <a href="https://www.gema.de/">GEMA</a> (Gesellschaft f&uuml;r musikalische Auff&uuml;hrungs).</p>
<p>To thwart these and similar threats, we recommend using a complete and up-to-date antivirus solution such as <a href="http://windows.microsoft.com/en-US/windows/products/security-essentials">Microsoft Security Essentials</a>.</p>
<p><em>--Raymond Roberts</em><br /><em>MMPC-Melbourne</em></p><div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3487035" width="1" height="1">
Source: Ransomware: Playing on your fears