Filecoder: Your data is being held at ransom

Trojans put messages into user files and try to demand a ransom from victims in exchange for a decryptor utility.  Ransomeware is commonly known as a locked screen on your desktop, which tries to scare you into making some kind of payment to regain access to your computer again.

This is an old issue but it is noted to be a significant increase in Filecoder activity this summer.

ESET has detections of this malware category flagged as Win32/Filecoder, Win32/Gpcode, and other family names.

Statistics on ESET LiveGrid telemetry shows Win32/Filecoder detections have risen by 200% just in the last few months.  From January to June 2013 the detections have been at a normal level, but the spike since July is alarming.

http://www.hyphenet.com/blog/filecoder-your-data-is-being-held-at-ransom/

Russia is most affected by these malware families, although these campaigns are spreading throughout the entire world.

http://www.hyphenet.com/blog/filecoder-your-data-is-being-held-at-ransom/

Photo Credit: We Live Security

 

Infection Trajectory

Cybercriminals that incorporate Filecoder randomware use various methods of getting the malware to victims' systems:

• Downloads from malware-laden websites
• E-mail attachments
• Trojan-downloader or backdoor
• Manual instillation (this hurts the most)
• Infection vectors

A scenario of the Win32/Filecoder.Q or the Win32/Filecoder.AA/Win32/Filecoder.W spreads through back-doors such as the Poison-Ivy R.A.T.  Victims are being sent the Poison-Ivy backdoor through email and are enticed to execute the malware onto their computer.  The C&C (command and control) server waits for the commands then the attacker would send the Filecoder Trojan  to the infected mainframe.

The Trojan is not stored as a file on the hard drive, but is ran in the memory of the computer.

There are other cases where the attacker manages to install Filecoder ransomware through Remote Desktop Protocal.   The keylogger is infected and weak passwords enable the attacker to gain full access to the aimed machine.

This "break in" disables antivirus protection while installing malware onto the compromised desktop.
Sometimes manual installation is needed due to the fact that a number of variants call for "user interaction", to set the encryption password.

 
http://www.hyphenet.com/blog/filecoder-your-data-is-being-held-at-ransom/

 

Encryption Methods

Various encryption methods are used like:

• Blowfish - a keyed symmetrick block cypher
• AES - an encryption of electronic data based on the Rijndael cipher
• RSA - an algorithm for public-key cryptography based on factoring large integers
• TEA - a block cipher with implementation of a few lines of code
• Hard coded in binary numbering system
• Entered manually by command-line or dialog box
• Randomly created and sent to the machine

It is a good idea to password-protect any anit-malware software you have on your computer to prevent it from being adjusted by an attacker.

It is also equally important to backup your computer regularly, make sure all your anti-virus software is up-to-date and all setting preferences are correct.

Here is a good reference for cybersecurity: How FireEye has redefined cyberdefense on USATODAY.com: http://www.usatoday.com/videos/tech/2013/09/24/2861507/

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

References:
Filecoder: Holding your data to ransom - We Live Security
http://www.welivesecurity.com/2013/09/23/filecoder-holding-your-data-to-ransom/
September 23, 2013

Linux/Cdorked.A Malicious Malware

The investigation with Linux/Cdorked.A continues.  There have been significant discoveries that this subtle and sneaky backdoor is designed to drive traffic to malicious websites.

• There are over four hundred webservers infected with the Linus/Cdorked.A. 50 ranked at Alexa's top 1000,000 hottest websites.


• The backdoor has been applied to alternative webserver daemons.  Lighttpd and nginx binaries have already been documented Apache binaries.


• The Linux/Cdorked.A threat is even more sneaky than thought.  The malicious content is not delivered to victim's IP address' that have long IP ranges.


• If the internet browser's language is set to Japanese, Russian, Finnish, Ukrainian, Kazkh, or Belarusian, it will not be affected.


• 1000,000 user's of ESET security products have browsed these infected websites by being redirected.  Even though the attack was blocked.


• In some cases fo the configurations, the tendency to analyze specific re directions were designed for Apple iPad and iPhone users.

These victims are redirected to a malicious web server that is hosting a Blackhole kit.  The infrastructures use compromised DNS servers, that's how they are able to get into them.  There is belief that the infection vector is not unique.   It can not be attributed only to installations of cPanel as a result of solely a fraction of the infected servers square measure exploitation this management software system.  This malware doesn't propagate by itself and it doesn't exploit any vulnerability during a specific software system.  Linux/Cdorked.A may be a backdoor, employed by malicious actor to serve malicious content from legitimate websites.

Typical Linux/Cdorked.A configuration

Thanks to the system administrators and Sucuri, the code has been reviewed and analyzed.   The configurations so far are only with a single URL.  The redirect is served to people using Internet Explorer or Firefox on Microsoft Windows XP, Vista or 7.  iPhone and iPads are also victims, they are not directed to the exploit kit but instead pornographic websites.


Please visit http://www.hyphenet.com/blog/ for more blog posts on the latest technology and IT security news.

Redirection Stats

In analyzing web traffic of the targeted websites, over 400 were identified with being affected by Linux/Cdorked.A.  50 of those sites are in the 100,000 websites ranked by Alexa.  All of these re directions have something in common.  The efforts in keeping their operation under the radar are putting in as much resistance as possible.  These sites are more concerned with not being detected instead of infecting as many as possible.

Hijacking the DNS

The URLs on the Linux/Cdorked.A infected servers adjust often.  The domain usually looks like numbers or letters.  The sub domain also matches a 16 character hexadecimal string.   The numbers at the beginning of the domains were hosting sites and shared hosting servers.  The pages that show pornographic images and links contain an iframe leading to the Blackholde landing page.  There is no clarity on if the pornographic domains are malicious or referred.

It is recommended to keep browsers, browser extensions, operating systems, and third party software like Flash players and PDF's up to date to avoid these infections.  Antiviruses are always recommended.

[via:WeLiveSecurity]