New Ransomware Take a Familiar Path... Why?

A new ransomware has been confirmed to be spreading through a phishing site. Phishing site was the same from what was previously used by the GandCrab ransomware. Users need to pay close attention to this type of attacks that still remain to be successful despite using known methods and paths. 

The newly discovered ransomware has been found to be distributed via a phishing site, which was used by GandCrab v5.2. This ransomware also behaves in a similar manner with GandCrab v5.2 where it waits 20 minutes after being downloaded onto a user's computer to avoid detection by antivirus products, to start malicious behaviors. The information and encoded data in the script file between the malwares is also very similar.

However, there are some differences in terms of the infection method. While GandCrab downloads malware through a JavaScript server, this new ransomware has the malicious code within its JavaScript code and does not need to download the malware additionally.  This means that threat actor has upgraded the malicious activities of the malware to spread this malware in an easier way using the same method and path as the GandCrab ransomware. 

On an infected PC, the malware creates a ransom note as shown in Figure 1. It then encrypts files in the PC and changes the desktop wallpaper to the image shown in Figure 2.    

[Figure 1] Ransom Note of the New Ransomware 

[Figure 2] Changed Desktop Wallpaper on an Infected PC 

 AhnLab’s V3 products detect the ransomware under the following aliases:

<V3 Product Aliases>

- JS/Gandcrab.S9 

- Malware/MDP.Behavior.M2084

- Malware/MDP.Behavior.M2193

- Malware/MDP.Behavior.M2194

In order to prevent damage from malware that are distributed through phishing sites, users must be careful not to access unverified URLs such as those contained in advertisements on websites or in emails. AhnLab provides various features, such as blocking malicious sites and blocking phishing sites, in V3 products to minimize damages caused by phishing and unsafe sites.​