Security researchers have discovered a newly discovered Ransomware-as-a-Service campaign that uses malware written in JavaScript for the first time. Fabian Wosar of Emsisoft has explained in his blog post that Ransom32 is used to sign up to on a Tor site using just a Bitcoin address to which the spoils will be sent without a 25% cut.
After the sign up, the users get access to basic admin page that enabled them to see how many systems are infected; observe how much money has been collected; and tweak various settings for the ransomware. These include how much BTC to request from victims, and whether to completely lock the computer or allow a victim to minimize the lock screen, giving them the ability to check whether their files are fully encrypted or not. Ransom32 is a 22MB self-extracting RAR file, which weighs in at over 67MB when extracted. Once run, the executable creates a shortcut, ChromeService, which points to a chrome.exe package.
that is actually a NW.js package that contains Javascript code that will encrypt the victim's data and then display a ransom note.
The files extracted into the Chome Browser folder are:
chrome - The Chromium license agreement.
chrome.exe - This is the main executable for the malware and is a packaged NW.js application bundled with Chromium.
ffmpegsumo.dll - HTML5 video decoder DLL that is bundled with Chromium.
g - The settings file that contains various information used by the malware. This information includes the affiliate's ransom amount, bitcoin address that they receive payments on, and error message that is shown in a messagebox if the Show a message Box setting was enabled.
icudtl.dat - File used by Chromium
locales - Folder containing various language packs used by Chrome.
msgbox.vbs - The messagebox displayed if the affiliate enabled the Show a message Box setting.
nw.pak - Required for the NW.JS platform.
rundll32.exe - Renamed TOR executable so that the malware can communicate with the TOR Command and Control server.
s.exe - Renamed Shortcut.exe from OptimumX. This is a legitimate program used by the malware to create the ChromeService shortcut in the Startup folder.
u.vbs - A VBS script that deletes a specified folder and its contents.
 |
| (pc-google images) |
that is actually a NW.js package that contains Javascript code that will encrypt the victim's data and then display a ransom note.
The files extracted into the Chome Browser folder are:
chrome - The Chromium license agreement.
chrome.exe - This is the main executable for the malware and is a packaged NW.js application bundled with Chromium.
ffmpegsumo.dll - HTML5 video decoder DLL that is bundled with Chromium.
g - The settings file that contains various information used by the malware. This information includes the affiliate's ransom amount, bitcoin address that they receive payments on, and error message that is shown in a messagebox if the Show a message Box setting was enabled.
icudtl.dat - File used by Chromium
locales - Folder containing various language packs used by Chrome.
msgbox.vbs - The messagebox displayed if the affiliate enabled the Show a message Box setting.
nw.pak - Required for the NW.JS platform.
rundll32.exe - Renamed TOR executable so that the malware can communicate with the TOR Command and Control server.
s.exe - Renamed Shortcut.exe from OptimumX. This is a legitimate program used by the malware to create the ChromeService shortcut in the Startup folder.
u.vbs - A VBS script that deletes a specified folder and its contents.
