A new ransomware spreading through email is on the loose.

On the outset, the worm detected by Trend Micro as WORM_RANSOM.FD may look like a normal mass-mailing worm but further analysis reveals that this comes with a deadly payload. With only a few exceptions (files with .rwg, .dll, .exe, .ini, .vxd, and .drv extensions are not affected), it encrypts files in the affected system using the Blowfish algorithm, thereby rendering them unusable. A .RWG extension is then appended to the filenames to serve as a marker.

Defying the norm of a typical ransomware however, WORM_RANSOM.FD does not ask for money in exchange for the files. Instead, it gives the affected user three options as to how he or she can retrieve his or her files:

So, unless Windows users are willing to migrate to Linux or wait for the decryptor program that may or may not come, Option 1 may seem the only plausible solution. Resourceful techies may opt to try their hand in manually decrypting the files, but for those stuck with Option 1, Trend Micro already provides a fixtool that will automatically restore the files.

Our experts believe that ransomware is a high-risk/moderate reward business model that will not significantly increase. This is because it goes against one of the key features most cybercriminals are relying on in terms of developing malware, which is stealth. Almost all aspects of a ransomware attack is quite visible.

For one, the payload is visible — users are informed that their files are held hostage, so these users can easily turn to their AV vendors for help in detection/cleanup, mitigating further infection from other users. Another is that cybercriminals have to leave contact details for the payment. These contact details can be used by law enforcement to track down the attackers.

Users who’ve found themselves victims of this attack may either use Trend Micro’s fixtool or ask for assistance.

If you're new here, you may want to subscribe to our RSS feed. Thanks for visiting!

Aside from the new Twitter component we’ve also seen Koobface download a new component with the filename dns.exe, whose main purpose, it seems, is to modify the system’s DNS registry settings.

It is accomplished by inserting 213.174.139.72 (IP of the rogue DNS server) into the values of NameServer and DhcpNameServer found in the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Tcpip\Parameters\Interfaces\{Device ID}

What this system modification does is, every time a website is visited, the domain of the website is resolved by asking the rogue DNS, which can then serve a bad IP that will redirect the unsuspecting user to a malicious or phishing site.

As of writing, the rogue DNS IP is inactive, but we recommend anyone who suspects that something fishy is happening while browsing should search for the presence of that bad IP and remove it (do NOT remove your original DNS IP though). The rouge DNS IP has a history of hosting various malware and malicious pages before so whatever it will do when it wakes up will be anything but good.

The said DNS changer is now detected as TROJ_DNSCHANG.UB, thus the Smart Protection Network also protects Trend Micro users from this.

Other notorious DNS-changers in the past can be read here:

• DNS Changer Malware Evolves – Again
• New ZLOB Rigs Routers
• Blended Targeted Attack in Mexico Now a DNS Changer and a Botnet

Recently, we came across JS_VIRTOOL which uses certain Javascript techniques so that encrypted code may not be decrypted and analyzed by a malware analyst.

Here is how this is done:

1. It retrieves the URL where the malicious script is located.
2. It retrieves its own function and adds the string of the URL.
3. It computes the CRC of the function plus the URL.
4. It decrypts an encrypted code in the script body using the CRC that was computed.
5. It executes the decrypted code using the eval() function.

Figure 1. Obfuscated code of JS_VIRTOOL

It uses its function and URL location as a decryption code. In this case, the encrypted code which is the real routine of the malware will not execute if the function is tampered and/or the URL is not correct.

If a malware analyst only has the script file sample without knowing where the file was downloaded from, he will not be able to know the malware’s actual routines since the URL is necessary for the decryption to take place. In addition, if this script is placed on another website aside from the “correct” one, it will not be successfully decrypted.

Currently, we have multiple samples that all use this particular technique, but have different encrypted contents. We suspect that they have the same decrypted data, the only difference being the URL location which will decrypt each sample. We believe that this as a technique which is intended to make it more difficult to track the source and cause of infection. This could potentially increase the time before these malicious scripts are detected and the appropriate solutions are released to users.