A Brand new ransomware attack widely distributed and infect the users based on their geolocation by checking the infected device IP address.
Malware authors designed this ransomware to avoid encrypting files for specific countries such as Russia, Belarus, and Kazakhstan.
If the Windows users infected by this Ransomware, it tries to find the device location whether the victim belongs to Russia else if the Russia regional parameters are set in the system preferences to avoid the encryption.
Due to the Malware authors coding error, it encrypts the files regardless of the device location even the victims belongs to encryption whitelisted countries.
This ransomware discovered Trojan.Encoder.25129 by Dr.Web security experts and cybercriminals claims that victims can restore the encrypted files but their code errors make impossible to decrypting the infected files that corrupted by an encoder.
Also Read: RansomwareAttack Response and Mitigation Checklist
How does this Ransomware Attack works
This ransomware mainly distributed through Social media that contains a malicious Payload and also it distributed through network shares.
Spam Emails is another distribution medium that contains embedded links and attached malicious files that carried the payload eventually infect the victim when victims open and execute it.
Initially, it using Windows Task Manager to installs itself and start its encryption process on the specific folders.
This ransomware is not capable of encrypting the files that exceed 30,000,000 bytes (about 28.6 MB).
According to D.Web report, Once the encryption is over, the “123” value is written into the %ProgramData%\trig file. The Trojan then sends a request to the iplogger website. The website address is hardcoded into the program’s body. The malicious program then displays a window with ransom demands.
IOC – SHA1:
-
de74dd60ba3448b072f03ad80001f6a903f60b60
