New crypto-ransomware "quarantines" files, downloads info-stealer

[Petrovic]

Content source

http://www.net-security.org/malware_news.php?id=3008

researchers have found and analyzed a new piece of crypto-ransomware: CryptVault encrypts files, makes them look like files quarantined by an AV solution, asks for ransom and, finally, downloads info-stealer malware.

It arrives on target computers after the user has been tricked into downloading and running a malicious attachment - a Javascript file - that downloads four files: the ransomware itself, SDelete (a MS Sysinternals tool that will be used to delete files), GnuPG (legitimate open source encryption tool), and a GnuPG library file.

Full Article

 

[starchild76]

these bastards are getting more inventive by the day! thanks for sharing! @Petrovic

 

[Secondmineboy]

At some point malware will be able to bypass every AV thats on the market right now

AVs might be dead at some point

 

[StriderHunterX]

This is getting scary by the day.I wanted to create a topic about TeslaCrypt(I have not seen a topic about it here) and my experience with it...

It was not good at all.ECC files everywhere....with no hope of unlocking them.

Backups and Images are becoming more crucial than ever.

 

[tallorder]

So are 'how to's' about exactly how to use the back up tools out there. As a novice, I was thwarted at option 1, and have yet to do any.

 

[soccer97]

Have we thought about using Group Policy (gpedit.msc) to prevent installations in certain directories? This of course can have it's drawbacks as it may sometimes prevent legitimate software being installed.