Ransomware
Ransomware is a kind of malware that keeps or cutoff user’s from getting their System, either by locking the system’s screen or by locking the user’s files unless ransom is paid. To read more about Ransomware.
FireCrypt’s manufacturer named BleedGreen (seen underneath) and permits the FireCrypt creator to produce an exceptional ransomware executable, give it a custom name, and use a customized record symbol.
Contrasted with other ransomware developers, this is a low-end application.
Comparative manufacturers more often than not let law breakers to alter a more extensive arrangement of choices, such as, the Bitcoin deliver where to get installments, the payment request esteem, contact email address, and the sky is the limit from there.
This threat was discovered today by MalwareHunterTeam and first posted in Bleeping Computer.
The strategy is regularly used by malware engineers to make alleged “polymorphic malware” that is harder to recognize by standard antivirus programming.
As indicated by MalwareHunterTeam, “the manufacturer is extremely fundamental, so this shouldn’t help anything against genuine AVs.”
Firecrypt pathology procedure
The FireCrypt contamination prepare relies on the ransomware’s merchant’s capacity to trap clients in propelling the EXE record they just created.
When this happens, FireCrypt will terminate the PC’s Task Manager (taskmgr.exe) and start to encrypt a rundown of 20 document files.
FireCrypt encrypts records with the AES-256 encryption calculation.
Once the document encryption prepares closes, FireCrypt drops its payment note on the client’s Desktop.
The DDoS work that fills your hard drive with garbage records
Subsequent to dropping the payment note, FireCrypt doesn’t stop its noxious conduct. Its source code has a capacity that persistently interfaces with a URL, downloads its files and save into the hard disk.
%Temp% folder, named [random_chars]-[connect_number].html
Current versions of the FireCrypt ransomware will download the content of http://www.pta.gov.pk/index.php, which is the official portal of Pakistan’s Telecommunication Authority.
The FireCrypt creator calls this element as a “DDoSer,” however this would be an extend. The crook would have to infect thousands of victims before launching a DDoS attack large enough to cause any problems to the Authority’s website.
Victims infected with this threat that is unable or unwilling to pay the $500 ransom demand should keep a copy of their encrypted files around, as a decrypter might be possibly released in the future.
Targeted file extensions:
General Methods to prevent Ransomware
