Zeus Trojan variant comes with ransomware feature
Posted on 22.05.2012
Bookmark and Share
The recent popularity of ransomware as a tactic for duping users into giving up their hard-earned cash has resulted in an unexpected malware combination.

F-Secure researchers have recently spotted a new Zeus 2.x variant that includes a ransomware feature.

Once this particular piece of malware is executed, it first opens Internet Explorer and points it towards a specific URL (lex.creativesandboxs.com/locker/lock.php). Simultaneously, the users are blocked from doing anything on their computer.

The site in question is offline, so it is difficult to say for sure what it contained, but a good guess would be an extortion message.

The command for "unlocking" the computer is present on the computer, in the registry, so it is possible to do so without paying the ransom.

According to the researchers, users who have found themselves effectively locked out of the computer must do the following:

1. boot the system in safe mode
2. add a new key named syscheck under HKEY_CURRENT_USER
3. create a new DWORD value under the syscheck key
4. set the name of the new DWORD value to Checked
5. set the data for the Checked value to 1
6. reboot

Obviously, the threat of having their financial and login information stolen after having unlocked the computer is still present, as the aforementioned steps haven't rid them of the malware.







Spotlight

Attackers use reflection techniques for larger DDoS attacks

Posted on 17 April 2014.  |  Instead of using a network of zombie computers, newer DDoS toolkits abuse Internet protocols that are available on open or vulnerable servers and devices. This approach can lead to the Internet becoming a ready-to-use botnet for malicious actors.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Apr 18th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //