Windows 10: Malware Ransom Threat

Niche_IS · May 1, 2019

I received a ransom request a few months ago via email. I ignored and deleted it expecting it was not real. I received the following threat this morning......I removed the password for security reasons, but the hacker knew my password. I have since installed Kaspersky Total Security and Malwarebytes. What else should I do? Can this hacker be tracked and brought to justice?

Hello!

This is important information for you!

Some months ago I hacked your OS and got full access to your account *** Email address is removed for privacy *** On day of hack your account *** Email address is removed for privacy *** has password: ########

So, you can change the password, yes.. Or already changed... But my malware intercepts it every time.

How I made it:

In the software of the router, through which you went online, was a vulnerability. I used it...

If you interested you can read about it: CVE-2019-1663 - a vulnerability in the web-based management interface of the Cisco routers.

I just hacked this router and placed my malicious code on it.

When you went online, my trojan was installed on the OS of your device.

After that, I made a full backup of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).

A month ago, I wanted to lock your device and ask for a not big amount of btc to unlock.

But I looked at the sites that you regularly visit, and I was shocked by what I saw!!!

I'm talk you about sites for adults.

I want to say - you are a BIG pervert. Your fantasy is shifted far away from the normal course!

And I got an idea....

I made a screenshot of the adult sites where you have fun (do you understand what it is about, huh?).

After that, I made a screenshot of your joys (using the camera of your device) and glued them together.

Turned out amazing! You are so spectacular!

I'm know that you would not like to show these screenshots to your friends, relatives or colleagues.

I think $725 is a very, very small amount for my silence.

Besides, I have been spying on you for so long, having spent a lot of time!

Pay ONLY in Bitcoins!

My BTC wallet: 1GLvEgpHZxBMhkcoUXP69owPTbHs51mHGe

You do not know how to use bitcoins?

Enter a query in any search engine: "how to replenish btc wallet".

It's extremely easy

For this payment I give you two days (48 hours).

As soon as this letter is opened, the timer will work.

After payment, my virus and dirty screenshots with your enjoys will be self-destruct automatically.

If I do not receive from you the specified amount, then your device will be locked, and all your contacts will receive a screenshots with your "enjoys".

I hope you understand your situation.

- Do not try to find and destroy my virus! (All your data, files and screenshots is already uploaded to a remote server)

- Do not try to contact me (you yourself will see that this is impossible, the sender address is automatically generated)

- Various security services will not help you; formatting a disk or destroying a device will not help, since your data is already on a remote server.

P.S. You are not my single victim. so, I guarantee you that I will not disturb you again after payment!

This is the word of honor hacker

I also ask you to regularly update your antiviruses in the future. This way you will no longer fall into a similar situation.

Do not hold evil! I just good do my job.

Good luck.

:)

Brink · May 1, 2019

Microsoft Advanced Threat Analytics - NotPetya malware

On June 27, 2017 reports on a new variant of Petya (which was later referred to as NotPetya) malware infection began spreading across the globe. It seems the malware’s initial infection delivered via the “M.E.doc” update service, a Ukrainian finance application. Based on our investigation so far, the propagation steps executed by the malware can be considered sophisticated and well tested.The malware distributes itself as a DLL file, spreading over internal networks using different lateral movement techniques.

This blog post focuses on the network behavior analysis of NotPetya and the techniques it uses to propagate in the network. This is ongoing research, and we’ll update with additional findings as those become available.

Malware Propagation Flows

Delivery & Initial execution

The malware is delivered via the “M.E.doc” service to infect the first endpoint.

The malware executes and extracts the relevant components to disk. These include:

PsExec – Network remote execution tool.

A credential dumping tool.

More information on these steps can be found at the Windows Security blog.

Reconnaissance

The internal network is probed using multiple discovery methods to identify new workstations and domain controllers. These include:

LANMAN NetServerEnum2 API used to get information about workstations and domain controllers.

Probing using ports 139 and 445 to other endpoints.

If a domain controller is accessible, the malware queries its DHCP Service to enumerate DHCP subnet.

In case DHCP subnets are discovered, the malware will continue its discovery against those subnets as well.

Reconnaissance example – NetServerEnum2

In the screenshot above, we can see the NetServerEnum2 API used by the infected machine.

The response includes the domain controller and a list of all known workstations response.

Lateral Movement

To spread itself on the network, the malware tries to access the administrative share ($admin).

If the SeDebugPrivilege privilege obtained (Step2), a credentials dumping tool is used to recover additional user credentials from the local memory.

Our lab tests have shown that in addition to the current account session, only one additional user is used by the malware to probe the remote hosts. The malware seems to ignore memory dumped users who were tagged under a new credentials session. Moreover, it seems like only one user (the last one who is in memory) is used to probe the destination host

Each target endpoint is accessed using multiple authentication protocols, such as NTLM and Kerberos over GSSAPI (SPNEGO). The credentials used for access are:

Current user context, under which the malware is running.

Successfully dumped credentials (if available).

In the screenshot below, we can see multiple CIFS ticket requests performed by the malware on behalf of the dumped user. Such broad abnormal access attempts performed by the malware will be detected by Microsoft Advanced Threat Analytics’ (ATA) abnormal behavior detection. Based on previously learned user behavior analytics, the detection mechanism will recognize and alert on the abnormal resource access performed by the malware using the compromised credentials.

Multiple TGS-REQ

In the screenshot above, we can see multiple CIFS ticket requests.

Example of abnormal user access – ATA

Remote Execution

If access to the administrative share was obtained, the malware copies itself to the target host and executes PSEXEC and WMIC.

Malware Copy

PSEXEC Service creation

In the screenshot above, the infected host starts executing the PSEXEC tool.

Exploitation (optional)

If all propagation steps failed, the malware tries to execute one of the SMB exploits (MS17-010).

Available SMB Exploits:

EternalBlue – CVE-2017-0144

EternalRomance – CVE-2017-0145

The above steps are performed simultaneously, using multiple threads and runs against each target host. For further information regarding the SMB exploit mitigation, malware encryption steps and initial infection stage, please refer to the Petya worm capabilities blog post.

The spreading capabilities used by the NotPetya malware introduce a new level of sophistication when executing lateral movement.

Detection and mitigation

Microsoft Advanced Threat Analytics allows customers to detect and to investigate a variety of advanced techniques including the lateral movement technique used by NotPetya.

This type of lateral movement can be detected by ATA as abnormal resource access – given the large scanning performed by the user to attempt access additional endpoints on the subnet.

There are several ways customers can detect and prevent NotPetya from impacting their environment.

First, we strongly recommend customers that have not yet installed security update MS17-010 to do so as soon as possible. If applying the patch is not possible, disable SMB V1 on the corporate networks.

Second, we recommend that you verify good credential hygiene. To learn more, read the following article about protecting high value assets with secure admin workstations.

Additional Resources

KB

MS17-010 Security Update

Blog

New ransomware, old techniques: Petya adds worm capabilities

Windows 10 platform resilience against the Petya ransomware attack

Click to expand...

Source: Advanced Threat Analytics security research network technical analysis: NotPetya Microsoft Secure

djbbenn · May 1, 2019

New Trojan that Demands a Ransom

There is a new virus out there discovered by virus hunters known as "Cryzip". The Trojan encrypts your files and then demands a $300 ransom for the decryption password to get your files back. After encrypting the files, the virus leaves a nice step-by-step guide of how to go about paying the ransom off. It's supposedly spread through email Spam, and has successfully evaded anti-virus scanners.

Source: eWeek

Borg 386 · May 1, 2019

Trojan malware: The hidden cyber threat to your PC

But while cryptojacking and ransomware continue to be widespread threats, other attackers have continued to quietly deploy a potentially much more damaging threat: trojan malware.

As the name suggests, trojan malware sneaks onto your PC by disguising itself as something else, often hidden in a malicious attachment that's distributed with a phishing email.
Click to expand...

It sometimes appears as if trojans have been overlooked when talking about hacking threats, with some seemingly dismissing the malware as old-hat, a dated means of attack. However, a recent report from security company Malwarebytes reveals how trojans and backdoor attacks have rocketed in the past year.

"We're seeing a new generation of stealers make an impact recently," says Jérôme Segura, head of threat intelligence at Malwarebytes.
Click to expand...

Trojan malware: The hidden cyber threat to your PC | ZDNet

Windows 10: Malware Ransom Threat

Malware Ransom Threat

Malware Ransom Threat

Malware Ransom Threat

Malware Ransom Threat - Similar Threads - Malware Ransom Threat

Malware Ransom and TouchScreen

Help needed for removing .Foop ransom malware from my PC

RANSOM WARE

Ransom Ware

Could 'Sharex' be a malware threat? how to remove?

ransome ware

Malware threats

General question - Malware or virus threat

Microsoft Advanced Threat Analytics - NotPetya malware