Malware News New C# Ransomware Compiles itself at Runtime

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/new-c-ransomware-compiles-itself-at-runtime/

A new in-development ransomware was discovered that has an interesting characteristic. Instead of the distributed executable performing the ransomware functionality, the executables compiles an embedded encrypted C# program at runtime and launches it directly into memory.

Discovered by MalwareHunterTeam, this ransomware contains an encrypted string that is embedded into the dropper as shown below.
...
.... ....

... .... ...
... ...
This method is probably being used to prevent the dropper from being detected by security software as any malicious behavior is hidden inside the encrypted string.

As for the ransomware itself, other than it saving the decryption key and IV to a file on the desktop, it is fully functional. Therefore, it wouldn't be surprising to see the ransomware being distributed at some point.

When executed, it will encrypt the files on the victim's computer and rename the files using the template sequre@tuta.io_[hex]. For example, a file called 11.jpg would be encrypted and renamed to sequre@tuta.io_31312E6A7067 .
...
... .... ...

While this ransomware is still in development, it does use an interesting feature that we have not seen in ransomware before. This goes to show how attackers continue to try and think up new ways to bypass security programs that protect your computer.