RAA – An entirely new JS ransomware delivering Pony malware

Posted by admin on

On 13th of June, while monitoring Twitter, we have observed an interesting tweet that reported a suspicious domain with an open directory listing. Among the listed files we found a zip archive containing a javascript. In this blogpost we will take a closer look at the javascript and we will show that it has ransomware capabilities, which we have dubbed RAA ransomware and that additionally delivers a dropping stage for the Pony malware.

Continue reading “RAA – An entirely new JS ransomware delivering Pony malware” →

Uncovering a ransomware-distribution campaign part 2

Uncovering a ransomware distribution operation – Part 2

Posted by admin on

In Part 1 we’ve analyzed a vast Crypt0L0cker ransomware distribution operation currently affecting continental Europe and ready to jump to new countries. In this second post we’ll analyze in detail the server side code used to dispatch the victims towards the correct websites, up to the ransomware itself. We’ll also analyze the ransomware behaviour and how it infects the victim’s computer.
Continue reading “Uncovering a ransomware distribution operation – Part 2” →

Ransomware Ransom Request

Ransomware – A Quick Overview

Posted by admin on

Ransomware is a type of malicious software (known as malware) that restricts, using encryption, access to data on your computer. Once the restriction takes place, a ransom is requested to unblock your data and if paid the restriction is removed, in theory. In principle, ransomware is a simple threat, yet one that has caused a lot of pain and expense in recent months due to its increasing popularity. The purpose of this article is to give a quick overview of ransomware, keeping it as simple as possible.
Continue reading “Ransomware – A Quick Overview” →