Tag Archive for: rounds

Trend Micro Dissects Big Head Ransomware Variants Currently Making The Rounds

/in


big head ransomware technical analysis shows still developing malware strain

Earlier this year, reports of a new ransomware family dubbed ‘Big Head’ appeared online in various malware databases. This malware is making the rounds through malvertisement campaigns that look like Windows updates and Word installers, which is rather concerning becuase less savvy users often fall for these attacks.

Researchers at Trend Micro began to dig into this malware as it and three variants were discovered, and have published a technical report on the samples. The first sample is a .NET compiled binary that drops three subsequent executables, 1.exe, Archive.exe, and Xarch.exe, which all have different purposes.

sample1 big head ransomware technical analysis shows still developing malware strain

1.exe embeds itself on the system, encrypts files with the ‘.poop’ extension, creates the ransom note, and changes the victim’s desktop background. Archive.exe drops another executable, a Telegram tool that establishes a line of communication with the threat actor to execute remote activities. Xarch.exe finally drops BXluSsB.exe, another ransomware that encrypts files and displays a fake Windows update to make the malicious activity seem legitimate.

sample2 big head ransomware technical analysis shows still developing malware strain

The second sample has similar activity, but substitutes an extra ransomware binary for an information stealer binary. This malware, identified as the WorldWind stealer, will grab browsing history, directory listings, running processes, product keys, network connections, and screenshots, all of which are likely exfiltrated to the threat actor’s Telegram.

sample3 big head ransomware technical analysis shows still developing malware strain

The third and final sample includes Neshta, a virus “designed to infect and insert its malicious code into executable files.” The researchers believe that this is a diversion technique to prevent tools designed to detect ransomware from triggering. It is also noted that with this sample, the ransom note and wallpaper are different from previous samples but contain similar information.

sample2 note big head ransomware technical analysis shows still developing malware strain

Though there are notable differences between all of the analyzed samples, the researchers at Trend Micro suspect that all of them come from the same malware developer. Trend thinks this is the case because the samples have similar routines or structures in their infection process, have the same email and Telegram accounts, and have other similar mistakes in the malware…

Source…

Fake Telegram apps are doing rounds that can hack your computer regardless of antivirus protection

/in






Fake Telegram apps are posing a huge threat to Windows users. It has been reported that the unauthentic version of the messaging app can hack your devices and put your information at risk. The cybersecurity researchers reported that the fake app has the ability to bypass antivirus systems

As per a report by Minerva Labs, fake installers of the Telegram app are being widely circulated on the Internet. It is reportedly being used to distribute Windows-based ‘Purple Fox’ backdoor on compromised systems.

“We found a large number of malicious installers delivering the same ‘Purple Fox’ rootkit version using the same attack chain. It seems like some were delivered via email, while others we assume were downloaded from phishing websites. The beauty of this attack is that every stage is separated into a different file which is useless without the entire file set. This helps the attacker protect his files from AV (antivirus) detection,” the researcher noted in the blog.

Purple Fox was first discovered in 2018. It is apparently one of the most malicious malware that can be planted in a system beyond the reach of security solutions and evade detection. Once it enters the system, it enables the backdoor to spread more rapidly. The security researcher revealed that such threat actors use legitimate software to drop malicious files.

“This time, however, is different. This threat actor was able to leave most parts of the attack under the radar by separating the attack into several small files, most of which had very low detection rates by AV engines, with the final stage leading to Purple Fox rootkit infection,” the researcher said.

It is advisable to download apps for legitimate places such as the Google Play Store or the Apple App Store. The apps carrying suspicious links should be avoided.

Watch Live TV in English

Watch Live TV in Hindi

Source…

Almost 200 rounds were fired in the UPS hijacking shootout between police and suspects, a Florida official says – CNN

/in

Almost 200 rounds were fired in the UPS hijacking shootout between police and suspects, a Florida official says  CNN
“HTTPS hijacking” – read more