Malware News Jigsaw ransomware 2.0: A fake or work in progress?

[Jrs30]

Content source

http://www.welivesecurity.com/2016/05/18/jigsaw-ransomware-2-0-a-fake-or-work-in-progress/

Just recently we reported on various ransomware types that failed in their malicious intentions. Some were cracked by security experts due to poor implementation, while others flopped because the decryption key had been ‘left’ on the victims’ machine, allowing decryption of files without paying the ransom.

But the threat seen by ESET researchers over the few last days falls into an entirely different category. As the detection name suggests, MSIL/Hoax.FakeFilecoder.A – dubbed also Jigsaw 2.0 – is not a fully-fledged ransomware, but it does try to feed off of ransomware’s current popularity amongst cybercriminals.

“So why is it labeled as hoax?” you might ask. Well, it lacks the main functionality of extortion malware – it can’t encrypt victims’ files, nor can it block access to the device. Mimicking recent failsomware Jigsaw (free decryptor available online), MSIL/Hoax.FakeFilecoder.A uses the graphics from the movie Saw, threatening to delete users’ files. As ESET analysis has proven, these claims are false as well.

Nevertheless, the threat posed by ransomware should not be underestimated as the number of its detections are on the rise. Even Jigsaw 2.0 has the potential to become dangerous and effective in the near future, if malware writers have more time to fiddle with it.

 

[BoraMurdar]

it's not fake , at least not this variant
Jigsaw ransomware takes a .PORNO twist and a new name

The developers of Jigsaw ransomware have renamed their malicious creation, given it a new file extension, and outfitted it with a new lock screen.
Jigsaw rebranded with the name "CryptoHitman," now appends the extension .PORNO to every file it encrypts.
This is not by coincide. The ransomware's new lock screen not only incorporates an image of Agent 47, the main protagonist in the Hitman video game series, but it also displays a series of pornographic images on the victim's computer.

A blurred out image of CryptoHitman's lock screen. Source: BleepingComputer

CryptoHitman also asks that victims send their ransom payment to "cryptohitman@yandex.com."
Other than those modest alterations, however, CryptoHitman is an exact copy of Jigsaw ransomware. As explained by Lawrence Abrams of Bleeping Computer:
"The only major differences is the new pornographic locker screen, the use of the Hitman character, the new .porno extension that is added to all encrypted files, and new filenames for the ransomware executables. Otherwise, this ransomware performs the same as the original Jigsaw Ransomware."
That means CryptoHitman still deletes hundreds if not thousands of a victim's filesfor every reboot of the computer and for every hour the victim does not pay the USD$150 ransom fee.

That's the bad news. The good news is that Michael Gillespie, a security researcher and member of MalwareHunterTeam, has updated the the Jigsaw ransomware decryptor so that it now decrypts files affected by CryptoHitman.
To use the decryptor, you need to first terminate "%LocalAppData%\Suerdf\suerdf.exe" and "%AppData%\Mogfh\mogfh.exe" in TaskManager and then use MSConfig to disable the startup entry related to those processes. Doing so will terminate the ransomware and prevent it from deleting any more of your files.
Once that's done, download Gillespie's decryption utility here and select the directory you would like the tool to decrypt or decrypt your entire hard drive if you prefer. The utility will then decrypt all of your selected files.
Your files will be restored to their decrypted state, but that doesn't mean they're necessarily free of infection. With that in mind, make sure you an anti-virus solution on your computer and use it to scan your files for your infections.

You just removed CryptoHitman from your computer; you don't want any other uninvited malicious software hanging around for the after-party.
As for ordinary users who haven't been infected by CryptoHitman, watch out for suspicious links, keep yourself patched and securely back up your data just in case.