Friday, July 19, 2024
EHA

Beware!! Magniber Ransomware Delivered via Microsoft Edge and Google Chrome as an Update

In an ongoing campaign, the threat actors are distributing Magniber ransomware as an update through modern web browsers.

Cybersecurity researchers at ASEC have closely monitored Magniber and reported that to deploy this ransomware the operators behind it are actively exploiting the Internet Explorer (IE) vulnerabilities for the last couple of years.  

But, now apart from Internet Explorer (IE), currently, the hackers are also exploiting the modern web browsers:- 

  • Microsoft Edge
  • Google Chrome

Technical Analysis

In the image below the distribution pages are shown that are opened in Microsoft Edge and Google Chrome, prompting users to install the fake update package with “.appx” extension. 

This fake Chrome or Edge’s Windows update package with .appx extension contains an authentic certificate which makes it look legit and allows the installation of the fake package.

Later, in the child paths of C:\Program Files\WindowsApps when the fake downloaded APPX package was executed, it automatically puts the maliciously crafted EXE and DLL files with the following name:-

  • For EXE file: wjoiyyxzllm.exe
  • For DLL file: wjoiyyxzllm.dll

Now here at this stage, the wjoiyyxzllm.exe file loads the wjoiyyxzllm.dll to execute a distinct function that is dubbed as “mbenooj.” After completing these stages now the Magniber ransomware gets deployed from the memory of wjoiyyxzllm.exe.

Once deployed, the ransomware starts encrypting all the files present on the user’s system and leaves a ransom note after completing the encryption procedure.

Now if you are thinking that why “APPX” files were chosen by the threat actors? They chose the APPX files due to their wide usage. However, in the below video you can see the whole thing in action.

Moreover, if anyone wants to decrypt the files encrypted by Magniber ransomware for free of cost then it’s not possible to do so. Before encrypting the system the Magniber ransomware do not steal any files, since it did not embrace the double extortion tactic in its operation. 

So, for now, the best solution to mitigate such attacks is to back up the data on a regular basis.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Website

Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles