The ever evolving ransomware targets Windows users and does not infect computers using the Russian language. The malware encrypts files located in multiple locations including local and remote drives, removable drives, mapped drives, and un-mapped network shares.
Cerber continues to evolve and is one of the most complex and sophisticated ransomware families to date. The ransomware is sold to distributors on underground Russian forums.
The original version appends the ".sage" extension to encrypted files and demands $150 in bitcoins for the decryption key. An second version, Sage 2.0, demands $2,000. Sage 2.2 was discovered in February 2017 and downloads its main payload to %Temp% folder.
The ransomware is distributed via spam emails and uses a combination of RSA and AES encryption. The ransomware continues to evolve and has also been circulating as a fake Chrome font pack that is distributed via compromised websites.
The ransomware impersonates Globe ransomware and appends various extensions to encrypted files. The ransomware continues to evolve and multiple variants continue to appear in the wild.
The ransomware uses exploits leaked by the Shadow Brokers and has infected a large number of computers including those in the government, telecom, and educational sectors. Files are encrypted denoted by the .WNCRYT extension. The bounty for WannaCry ranges from $300 to $600 but payments may not be uniquely associated with a system. The initial variants of WannaCry no longer encrypts if the sample can resolve an external DNS which is held by security researchers.
The ransomware encrypts the MBR (Master Boot Record) as well as files on the infected system. The malicious software has crippled computers worldwide including government facilities, electrical grids, banks, and public transportation systems.
The ransomware threatens to delete files every hour unless the victim pays the ransom. Victims are infected after being tricked into believing they are downloading fraudulent versions of various software. Variants of the malware also report the encrypted files will be sent to your contacts if the ransom is not paid.
The ransomware demands $5,000 for the decryption key and is delivered via a malicious Word document. The malicious software is known to target numerous sectors including healthcare, critical manufacturing, and information technology.
The ransomware appends multiple extensions to encrypted files including .jaff and .wlu. The malicious software is distributed via spam email and uses RSA and AES-256 encryption.
FessLeak - Ransomware
9.00
6.00
Description:
The ransomware is delivered via corrupted advertisements on popular Web pages.
