New Ransomware Malware takes Advantage of Windows PowerShell




In this case, using PowerShell made it easier to detect as this malware is also hard-coded,” reads the blog post. “Decrypting and analyzing this malware was not too difficult, particularly compared to other ransomware variants.

TROJ_POSHCODER.A is a script-based malware as it is using the Windows PowerShell feature. The malware makes use of the Advanced Encryption Standard (AES) to encrypt the files, and RSA-4096 public key cryptography to exchange the AES key with the victims in order to decrypt the files.

Once the ransomware is installed and executed on the victim’s Windows System, it encrypts the existing files on the infected system and then renames them to {filename}.POSHCODER. In Addition, it also drops UNLOCKYOURFILES.html into every folder.

As soon as all the files on the infected system are encrypted, it displays a message to victims saying “Your files were encrypted and locked with a RSA4096 key” and ask them to follow some given instructions in order to decrypt their files as shown in the screenshot:
New Ransomware Malware takes Advantage of Windows PowerShell
The instructions in the Ransom note takes users to another page as shown below, asking victims to download the Multibit application to have their own Bitcoin-wallet account for 1 Bitcoin.
New Ransomware Malware takes Advantage of Windows PowerShell
After victims purchase the application, they are instructed to fill and submit the form that contains information such as victims’ email address, BTC address and ID, as a result to get decryption keys from the threat actors. This new variant have primarily affected English speaking targets in the United States.

In our previous articles, we highlighted many variants of Cryptolocker and other similar threats that has ability to perform additional tasks such as using different languages in their warning and stealing virtual currency from cryptocurrency wallets.

CryptoLocker is especially dangerous because of its infection rate and it is the most damaging Windows virus in a series of recent ransomware Trojans.


