Researchers have discovered a new malspam email campaign, which aims to distribute Cyborg ransomware to victims' machines.
How does the malspam campaign work?
Victims receive a spam email, supposedly from Microsoft . The email states that the latest Windows update (Microsoft Windows Update) should be installed immediately . It even includes an attached file through which users can perform the update.
Of course, this is a fake attachment, which has a random name and the file extension “.jpg”. In reality, it is a malicious executable of 28KB in size.
If users open the attachment (as the email tells them to), it will run a will then install other malware malicious .NET downloader , which on victims' computers.
The researchers found the #Strings section, which helped them understand some things about the executable. What they noticed is that the supposed update downloads another executable file from GitHub.
Cyborg Ransomware
The above process results in the installation of Cyborg ransomware. Successful execution of the ransomware results in the encryption of the infected system's files.
Researchers noticed that Cyborg appends the “.777” extension to encrypted files.
After the encryption process is complete, Cyborg ransomware displays a message on the victims’ desktop informing them of the attack and the amount of money they must pay. In most cases, the hackers demanded $500 to decrypt the files. The money had to be transferred to the bitcoin wallet mentioned in the message.
Trustwave researchers , who investigated the case, found 3 other samples of Cyborg ransomware and noted that: “The file extension added to the encrypted files varies. This is an indication that there is a builder for this ransomware.”
“Ransomware can be created and spread by anyone who gains access to the builder,” the researchers.
The more convincing spam emails used in campaigns, the more likely it is that victims' systems will be infected with Cyborg ransomware.
