Thursday, March 28, 2024

New KeyPass Ransomware Actively Attacking Around the World To Encrypt the Victim Files

Newly emerging KeyPass ransomware actively spreading around the world to encrypt the targetted system files and demand the ransom to the victims.

When compared to last year, currently ransomware outbreaks are very less, however, new ransomware attacks are kept increasing and the malware authors always trying to find the new method into infiltrate system to make a huge profit.

Main Payload dropped via trojan that is written in C++ and compiled in MS Visual Studio and the compiled data has been discovered from PE header.

Unlike other ransomware attacks, malware authors added new futures that give to take “manual control” by default.

                                           GUI of the trojan

This capacity may be a sign that the hackers behind the Trojan mean to utilize it in manual Attacks.

KeyPass Ransomware Infection Flaw

An initial stage of propagation starts from the fake installers that download the ransomware module.

once victim clicks the malicious files and open then the trojan copies its executable to %LocalAppData% and delete itself from the original location, also it skips of some of the directories.

According to Kaspersky Researchers,  The developers of this Trojan implemented a very simplistic scheme. The malware uses the symmetric algorithm AES-256 in CFB mode with zero IV and the same 32-byte key for all files. The Trojan encrypts a maximum of 0x500000 bytes (~5 MB) of data at the beginning of each file.

KeyPass connects to its command and control (C&C) to receive the encryption key and the data is transferred over plain HTTP.

After the complete execution, it encrypts all the disk files and adds the additional extension “.KEYPASS” including images, videos, doc etc.

Later it displays the ransom notes that contain the detailed description about the decryption process of the infection file

                                                           Ransomware notes

Attackers instruct victims to contact via particular email ID([email protected]) along with victims personal ID and they demand $300 for providing the decryption key.

IOC

901d893f665c6f9741aa940e5f275952 – Trojan-Ransom.Win32.Encoder.n
hxxp://cosonar[.]mcdir.ru/get[.]php
Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles