Be Careful Of Your Updates! [Important Information]

[AceInfinity]

Even though files are deemed as updates, you should always check them for validity before installing them, or install at your own risk.

Recently there was an update for firefox from a fake firefox site

Code:

http:// firefox.perl .sh

File Info:
MD5: 9a6f87b4be79d0090944c198a68012b6

Originally, there were only 3 detections for it:
https://www.virustotal.com/file-scan/rep...1299783978
(Almost all of the great AV's were unaware of this file's malicious activity it looks like)

But after a while it became more known with AV's and it's detection rate raised up to 40/42 of the online built in scanners:
https://www.virustotal.com/file-scan/rep...1302561162

A friend of mine had this on his computer:


A result of downloading this file.

The file appears to lock all application executions, as well as your entire Operating System from being used, and it prompts you with this message instead.

I took the file off his computer, and did some testing with it on my own unaware that this Ransomware would "release" itself after a while. Since there was an area for a key activation to allow you to access your Operating system again.



Here would be your next screen. However all of those given numbers are invalid.

Testing this with a few debugging tools on my own machine gave me a key: 1351236 Which apparently is the real key to get back into your system. Each digit has to be entered into the textboxes.

However this would be a pretty dangerous file, the Ransomware actually gives you a valid key after quite a few tries I believe, with testing those numbers given of course, which was the only catch. It worked for some people but didn't for me.)

I was actually pretty intrigued at how the newer generation of trojans have become so diverse in human engineered malware. Also at how people came up with the idea to create a system locker like this is pretty frightening.

This exact file was also released as an adobe flash update executable from what i've read. All sites hosting this Ransomware have been removed by the bigger parties though I believe.

[Peter L]

Wow thanks for this..but I doubt that would happen on W7 anytime soon.

[AceInfinity]

I believe this was for Windows 7 as well. It was a Ransom Trojan that came out a few months back

The reason for those numbers given is because the trojan author will earn money from every call to those numbers (short stopping). Genius human engineering at it's finest...

[MrTylerHaz]

Thanks for the share dude, saved my ass.

[AceInfinity]

The way this trojan actually works, is that it encrypts all the files on your computer, and doesn't give them back until you enter their registration key. It doesn't just block you out of your system, it basically holds your files in a virtual "safe" and holds them "ransom".

[yt]http://www.youtube.com/watch?v=WyAmC6DPRzw#at=458[/yt]

[Kom]

Wow, that's actually really cool if you think about it. Sucks for the person it happens too, but just the thought of the trojen it self is really quite amazing.

Thanks for the share =)

[AceInfinity]

No problem, this is a really quite unique version of a ransom trojan. They can be one of the most dangerous trojans to get in my opinion.

[Xplosion™]

wow thanks for the share, it would suck if it happened to someone.

[AceInfinity]

It was pretty interesting when I encountered it and started to learn about it at first

[BreShiE]

Now I get why they call it "Cyber Terrorism", they're holding your files hostage for money, how typical.

I have to admit, whoever came up with this is a genius, this could earn tens of thousands if spread in the right way, wow that's so amazing. It doesn't even damage your system either? It sounds like the creator of this, if he was to run by a hat, would be grey hat.

He / she's not doing it for malicious intentions but instead doing it for money, wow. That's one smart guy. I remember exploiting big sites just to replace their adds with mine, to generate me revenue, but this, is, amazing!

---

Extra: It would of been better if there was a possible way to have a unique code per machine so they have to call the numbers. Or have like 10 codes which work, it would then take people lots of time to realise they all work. Still genius work though.