Saturday, June 22, 2024

New KeyPass Ransomware Actively Attacking Around the World To Encrypt the Victim Files

Newly emerging KeyPass ransomware actively spreading around the world to encrypt the targetted system files and demand the ransom to the victims.

When compared to last year, currently ransomware outbreaks are very less, however, new ransomware attacks are kept increasing and the malware authors always trying to find the new method into infiltrate system to make a huge profit.

Main Payload dropped via trojan that is written in C++ and compiled in MS Visual Studio and the compiled data has been discovered from PE header.

Unlike other ransomware attacks, malware authors added new futures that give to take “manual control” by default.

                                           GUI of the trojan

This capacity may be a sign that the hackers behind the Trojan mean to utilize it in manual Attacks.

KeyPass Ransomware Infection Flaw

An initial stage of propagation starts from the fake installers that download the ransomware module.

once victim clicks the malicious files and open then the trojan copies its executable to %LocalAppData% and delete itself from the original location, also it skips of some of the directories.

According to Kaspersky Researchers,  The developers of this Trojan implemented a very simplistic scheme. The malware uses the symmetric algorithm AES-256 in CFB mode with zero IV and the same 32-byte key for all files. The Trojan encrypts a maximum of 0x500000 bytes (~5 MB) of data at the beginning of each file.

KeyPass connects to its command and control (C&C) to receive the encryption key and the data is transferred over plain HTTP.

After the complete execution, it encrypts all the disk files and adds the additional extension “.KEYPASS” including images, videos, doc etc.

Later it displays the ransom notes that contain the detailed description about the decryption process of the infection file

                                                           Ransomware notes

Attackers instruct victims to contact via particular email ID([email protected]) along with victims personal ID and they demand $300 for providing the decryption key.

IOC

901d893f665c6f9741aa940e5f275952 – Trojan-Ransom.Win32.Encoder.n
hxxp://cosonar[.]mcdir.ru/get[.]php
Website

Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles