Wednesday, June 19, 2024

Ransomware-as-a-Service – Now Anyone can Download Free Ransomware that is Available on Dark Web

Researchers discovered a new Ransomware as a service threat available in the Dark web with free of cost without any registration.

Instead of distributing the Malware and infect the computer, Malware authors are earning money by selling their malware via Ransomware as a service cybercrime business model.

In this case usually, ransomware developer host their services in dark web and anyone can buy it and they can change their own modification such as ransom amount, ransom notes.

Apart from this, some sophisticated Ransomware having some advanced functions such evasion techniques to avoid detection and analysis also users will be provided a control panel to control each and every infected victim.

Also Read:  Ransomware Attack Response and Mitigation Checklist

Ransomware as a Service

Buyers just need to set up their vault address and they need to customize it then later they will spread the malware.

So once infect victims paid the ransom amount then the percentage of the amount will deliver both buyer and the malware author who create this ransomware.

How Does this Ransomware as a Service Works

This Ransomware as a Service underground Process is well organized and well-planned cybercrime operation.

Buyer can get the ransomware from secret Tor Website (onion) that includes a guide that helps buyer for proper configuration process.

Ransomware as a Service

In this case, before reach the original version, buyers can try the demo version of the ransomware.

Buyer only needs to add their bitcoin wallet address and the ransom amount that they want to demand from the victim.

After completed this process, Malware will be successfully generated and the user can be downloaded it.

Once buyer successfully distributed and compromise the victims and if the victim will be paid the ransom amount then the 10% of ransom amount will be transferred into the original developer’s wallet.

Free Ransomware Running Process

Once it launched into the Victims system, initially it checks the internet connection, if it finds an internet connection then it will terminate its process.

But once it finds the connection then it will communicate with a specific address and download an encryption key.

According to McAfee Labs,Once the file is running, it creates several files on the system:
  • Encryption_key: the RSA key encrypted in AES
  • Lock_file: an indicator that the system is encrypted
  • Uuid_file: a reference for the infected machine. A TOR address is generated with this ID.

After the successful process of encryption, it displays the ransom notes on the user desktop and it points to the TOR site hxxp://kdvm5fd6tn6jsbwh[.]onion with the ID of the infected machine.

Once the payment will be made by the victims then they can download the decryption key to unlock the Encryption key.

“The targeted extensions include many picture and photography files related to Canon, Kodak, Sony, and others. There are also extensions for AutoCAD, Autodesk projects, scalable vector images, and Microsoft Office files. These files are mostly used by designers, photographers, architect—and many others. “


Latest articles

Amtrak Data Breach: Hackers Accessed User’s Email Address

Amtrak notified its customers regarding a significant security breach involving its Amtrak Guest Rewards...

Chrome Security Update – Patch for 6 Vulnerabilities

Google has announced a new update for the Chrome browser, rolling out version 126.0.6478.114/115...

Hackers Weaponize Windows Installer (MSI) Files to Deliver Malware

Cybersecurity researchers have uncovered a sophisticated malware campaign orchestrated by a threat actor group,...

Hackers Using VPNs To Exploit Restrictions & Steal Mobile Data

Hackers are offering "free" mobile data access on Telegram channels by exploiting loopholes in...

New PhaaS Platform Lets Attackers Bypass Two-Factor Authentication

Several phishing campaign kits have been used widely by threat actors in the past....

Stuxnet, The Malware That Propagates To Air-Gapped Networks

Stuxnet, a complex worm discovered in 2010, targeted Supervisory Control and Data Acquisition (SCADA)...

Threat Actors Claiming Breach of AMD Source Code on Hacking Forums

A threat actor named " IntelBroker " claims to have breached AMD in June...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles