Monday, May 5, 2025
HomeComputer SecurityNew Anatova Ransomware Encrypt the Users Data & Demands $700 USD Per...

New Anatova Ransomware Encrypt the Users Data & Demands $700 USD Per User to Unlock the Files

Published on

SIEM as a Service

Follow Us on Google News

Researchers discovered new Anatova Ransomware which is called as modular ransomware that encrypt users data with new techniques and demands $700 to unlock the files.

The ransomware is a turnkey business for some criminals, and victims still pay the ever-increasing demands for ransom, it’s become a billion-dollar industry that shows no signs of going away anytime soon.

In this case, researchers used the term called “modular” for Anatova Ransomware, which means, The ransomware using many different ways to infect the victims with the ultimate motivation of encryption data.

- Advertisement - Google News

Based on the Anatova ransomware structure, Malware authors are highly skilled and ability to use different types of algorithm and also using the modular technique plans to infect more in future.

Anatova is one of the distractive Ransomware with high intelligence futures and unlike other ransomware, it doesn’t add any file extension after complete the encryption process.

Also Read: New Mongolock Ransomware Attacking Database to Encrypt & Deleting Files

Anatova Ransomware Infection Process

Initially, the Anatova Ransomware delivering through in various medium such as weaponized doc or PDF, social media, and spam emails.

Once it entered into the system, it starts using the intelligence and evasion techniques and gain the system information such as user name using an API called GetUserName.

later It starts the encryption process and encrypts the all the disk files except the files that exist in the important folder such as ‘windows’, ‘program files’, ‘program files(x86)’,’boot’ etc. which helps to run the OS.

During the encryption process, Anatova Ransomware terminates the encryption process of associated files of the following processes.

msftesql.exeagntsvc.exeisqlplussvc.exeocomm.exeonenote.exe
sqlagent.exexfssvccon.exemysqld.exeoutlook.exe
sqlbrowser.exemydesktopservice.exemysqld-nt.exepowerpnt.exxe
sqlwriter.exeocautoupds.exemysqld-opt.exesteam.exe
sqlservr.exeagntsvc.exeagntsvc.exedbeng50.exethebat.exe
ocssd.exeagntsvc.exeencsvc.exesqbcoreservice.exethebat64.exe
oracle.exefirefoxconfig.exeexcel.exethunderbird.exe
dbsnmp.exetbirdconfig.exeinfopath.exevisio.exe
synctime.exemydesktopqos.exemsaccess.exe
winword.exewordpad.exemspub.exe

Also, it skips the some of the file extensions that are existing in the important locations such as ‘windows’, ‘program files’, ‘program files(x86)’,’boot’ etc and some few file extension such as exe, .cmd, ini & .dll etc.

According to Quick Heal Research, “Smartly, this ransomware encrypts files whose size is =<1MB, and if the size is more than 1 MB then it will only encrypt the data of 1 MB from that file, we suspect that it does it to take lesser time for encryption and to avoid the detection from the security software.”

During the encryption process it using a combination of RSA and Salsa 20 Algorithm that helps not to encrypt the same file again.

Anatova Ransomware not only encrypt the infected host but also it checking the remote network location and its delete the shadow copy once it complete its encryption process.

Later its drops the ransom notes into infected victims desktop that contains the complete information about ransom payment and decryption process steps.

After encryption, Anatova demands ransom payment in cryptocurrency of 10 DASH which calculates to somewhere around $700 USD, Researchers said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:Ransomware Attack Response and Mitigation Checklist

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Claude AI Abused in Influence-as-a-Service Operations and Campaigns

Claude AI, developed by Anthropic, has been exploited by malicious actors in a range...

Threat Actors Attacking U.S. Citizens Via Social Engineering Attack

As Tax Day on April 15 approaches, a alarming cybersecurity threat has emerged targeting...

TerraStealer Strikes: Browser Credential & Sensitive‑Data Heists on the Rise

Insikt Group has uncovered two new malware families, TerraStealerV2 and TerraLogger, attributed to the...

MintsLoader Malware Uses Sandbox and Virtual Machine Evasion Techniques

MintsLoader, a malicious loader first observed in 2024, has emerged as a formidable tool...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Claude AI Abused in Influence-as-a-Service Operations and Campaigns

Claude AI, developed by Anthropic, has been exploited by malicious actors in a range...

Threat Actors Attacking U.S. Citizens Via Social Engineering Attack

As Tax Day on April 15 approaches, a alarming cybersecurity threat has emerged targeting...

TerraStealer Strikes: Browser Credential & Sensitive‑Data Heists on the Rise

Insikt Group has uncovered two new malware families, TerraStealerV2 and TerraLogger, attributed to the...