Free Newsletter
Register for our Free Newsletters
Newsletter
Zones
Access Control
LeftNav
Alarms
LeftNav
Biometrics
LeftNav
Detection
LeftNav
Deutsche Zone (German Zone)
LeftNav
Education, Training and Professional Services
LeftNav
Government Programmes
LeftNav
Guarding, Equipment and Enforcement
LeftNav
Industrial Computing Security
LeftNav
IT Security
LeftNav
Physical Security
LeftNav
Surveillance
LeftNav
View All
Other Carouselweb publications
Carousel Web
Defense File
New Materials
Pro Health Zone
Pro Manufacturing Zone
Pro Security Zone
Web Lec
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
 
News

Encryption Trojan demands ransom for decryption.

MicroWorld Technologies : 01 August, 2007  (Technical Article)
Latest Trojan demands ransom for decoding corrupted files on victim's computer.
New ransomware is spreading on the Internet. It encrypts a whole lot of files on your computer and asks you to pay up $300 to give you the decryption code for recovering the data, say Security Experts at MicroWorld Technologies.

The malware comes into computers through Internet downloads and as a part of dubious programs and utilities. Named as 'GPcode.ai', the Trojan raises the current user rights to a higher level in order to modify files and to make changes in the Windows registry. GPcode.ai also injects itself into a legitimate Windows process to remain in the memory and avoid detection.

The ransomware then searches for more than 200 file types and encrypts them all! It also tries to send the stolen data to the remote attacker. What the victim of the attack is left with is hordes of garbage files, and a text file that reads as follows:

Hello, your files are encrypted with RSA-4096 algorithm (Link to Wikipedia URL removed).
You will need at least few years to decrypt these files without our software.
All your private information for last 3 months were collected and sent to us.

To decrypt your files you need to buy our software. The price is $300.
To buy our software please contact us at ------------- and provide us
your personal code ----------- . After successful purchase we will send
your decrypting tool, and your private information will be deleted from our system.

"The claim about RSA-4096 is a bogus one as the encryption is done with a much simpler technology," points out Vikas Vishwasrao, Assistant Manager - R&D, MicroWorld Technologies. "But the false claim and the link to the RSA page on Wikipedia is clever Social Engineering, to make you part with your money at the earliest. Like most malware gangs today, the one behind this too is looking for some quick dollars".

Though a few cases of ransomware infections were reported last year, this is the first such significant incident in 2007. MayArchive.a was one such malware which directed users to buy pharmaceuticals worth $75 from a Russian website at virtual gunpoint. Another one named GpCode.af used an actual RSA algorithm for encrypting files.

Security experts are keeping a close watch on this tribe of malware. CEO of MicroWorld, Govind Rammurthy, says: "While one branch of malware programs is moving towards stealthier varieties and camouflaged techniques, this offshoot is rather a brazen variety which shows that cyber criminals can go to any levels in stealing your money. Surely, it also points to the need of backing up your data regularly and protecting your computer with a proactive, real-time Antivirus solution".
Bookmark and Share
 
Home I Editor's Blog I News by Zone I News by Date I News by Category I Special Reports I Directory I Events I Advertise I Submit Your News I About Us I Guides
 
   © 2012 ProSecurityZone.com
Netgains Logo