After analysis of the MoneroPay ransomware (MD5: 14ea53020b4d0cb5acbea0bf2207f3f6), we managed to patch the binary to turn it into a decryptor.
Sunday, 4 February 2018
Friday, 22 December 2017
Friday, 27 October 2017
BadRabbit launched on the morning of Tuesday, October 24, 2017 was delivered through drive-by downloads of the fake Adobe Flash Player installer from the hacked websites. The installer came undetected with a Symantec digital certificate and 1 out of 65 detection rate on VirusTotal. The Bad Rabbit ransomware having the similar set of features and code snippets to the NotPetya wiper can be considered like its new version supposedly created by the same author. In the new version, the legitimate DiskCryptor driver used to install the bootloader and encrypt the hard disk volumes in a hidden way.
- The BadRabbit is a new version of NotPetya, supposedly written by the same author;
- It's a cryptolocker - you can unlock the computer and decrypt the data only by paying 0.05 BTC;
- This is not a targeted attack, unlike NotPetya
- The BadRabbit is distributed over the local network using the EternalRomance vulnerability in SMB1, WMI, WebDAV, brute-force with simple passwords through NTLMSSP
- The BadRabbit uses the legitimate DiskCryptor driver
Monday, 2 October 2017
This summer, Ukraine unwillingly became the battlefield of the hacker group(s) with the supposedly Russian roots and the antivirus industry. This is not the first time when Ukraine attracts attention of cyber security experts. Suffice it to recall in this regard the several waves of cyber attacks against critical infrastructure of Ukraine using the BlackEnergy  and Industroyer [2,3] industrial malware supposedly created by a Russian hacker group.
Thursday, 14 September 2017
Facebook and Google Docs continue to be used by scammers as a delivery channel for malware and adware.
In October 2016, Facebook users were sent the links to supposedly adult videos  that can be played from a fake Youtube portal only when a target downloads and install the malicious Video Plugin.
In August 2017, the same attack vector is used to spread adware .
And today, I saw the following message on my Facebook arrived from the hacked mobile Facebook app of one of my students in past. In addition to the message, I and other victim’s friends were marked in the comment to the post with a fake video.
Thursday, 10 August 2017
The new Octopus cryptolocker being an offspring of the Serpent/Zyklon/WildFire/HadesLocker families shows that .NET ransomware can be not an easy meat for a reverse engineer. It leverages several types of obfuscation, code encryption, and anti-debugging to protect its C# code from decompilation and analysis.