New KeyPass Ransomware Actively Attacking Around the World To Encrypt the Victim Files

Newly emerging KeyPass ransomware actively spreading around the world to encrypt the targetted system files and demand the ransom to the victims.

When compared to last year, currently ransomware outbreaks are very less, however, new ransomware attacks are kept increasing and the malware authors always trying to find the new method into infiltrate system to make a huge profit.

Main Payload dropped via trojan that is written in C++ and compiled in MS Visual Studio and the compiled data has been discovered from PE header.

Unlike other ransomware attacks, malware authors added new futures that give to take “manual control” by default.

This capacity may be a sign that the hackers behind the Trojan mean to utilize it in manual Attacks.

KeyPass Ransomware Infection Flaw

An initial stage of propagation starts from the fake installers that download the ransomware module.

once victim clicks the malicious files and open then the trojan copies its executable to %LocalAppData% and delete itself from the original location, also it skips of some of the directories.

According to Kaspersky Researchers,  The developers of this Trojan implemented a very simplistic scheme. The malware uses the symmetric algorithm AES-256 in CFB mode with zero IV and the same 32-byte key for all files. The Trojan encrypts a maximum of 0x500000 bytes (~5 MB) of data at the beginning of each file.

KeyPass connects to its command and control (C&C) to receive the encryption key and the data is transferred over plain HTTP.

After the complete execution, it encrypts all the disk files and adds the additional extension “.KEYPASS” including images, videos, doc etc.

Later it displays the ransom notes that contain the detailed description about the decryption process of the infection file

Attackers instruct victims to contact via particular email ID(keypass@bitmessage.ch) along with victims personal ID and they demand $300 for providing the decryption key.

IOC

901d893f665c6f9741aa940e5f275952 – Trojan-Ransom.Win32.Encoder.n
hxxp://cosonar[.]mcdir.ru/get[.]php