Stories
Slash Boxes
Comments

SoylentNews is people

CryptoWall Ransomware Variant Gets New Defenses

posted by LaminatorX on Sunday January 11 2015, @07:17AM   Printer-friendly
from the another-brick dept.

AnonTechie writes:

CryptoWall, one of a family of malware programs that encrypts files and demands a ransom from victims, has undergone a revamp that is frustrating security researchers.

Cisco's Talos Security Intelligence and Research Group has now analyzed a second version of CryptoWall that has improvements that make it harder to detect and study.

The sample of CryptoWall analyzed by Cisco was sent via email in a ".zip" attachment. Contained in that attachment is an exploit that uses a Microsoft privilege escalation vulnerability, CVE-2013-3660 ( http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3660 ), to gain greater control over the computer, Carter said.

If opened, CryptoWall doesn't decrypt its whole binary but instead just a small part, which then checks to see if it is running in a virtual environment, Carter said.

CryptoWall won't continue to decrypt itself if it is running in a virtual machine. Files are sometimes analyzed in a sandbox within a virtual machine to check if they're possibly malicious.

http://www.computerworld.com/article/2865303/cryptowall-ransomware-variant-gets-new-defenses.html

Cisco has a full technical writeup on its blog. http://blogs.cisco.com/security/talos/cryptowall-2

 
This discussion has been archived. No new comments can be posted.
CryptoWall Ransomware Variant Gets New Defenses | Log In/Create an Account | Top | 32 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 1) by KilroySmith on Sunday January 11 2015, @04:12PM

    by KilroySmith (2113) on Sunday January 11 2015, @04:12PM (#133714)

    "safe mode" isn't intended as a anti-malware feature. It's intended to get around bad drivers or bad apps that crash the system on boot.

  • (Score: 2) by FatPhil on Monday January 12 2015, @05:16PM

    by FatPhil (863) <reversethis-{if.fdsa} {ta} {tnelyos-cp}> on Monday January 12 2015, @05:16PM (#134064) Homepage
    To get around *unintentionally* bad drivers, yes. However, I've worked with Kernels/OSes a fair bit, and in my experience, the kind of idiots who write shitty drivers are the kind of idiots who insist that their driver is so important it must install itself with an asterisk (and then keep reinstating itself each boot). Running with the highest privileges available on the system, of course.
    --
    Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves