The government of India has issued a ‘Virus Alert’ via The Indian Computer Emergency Response Team (CERT-In) after a new type of ransomware was found spreading through email. The ransomware is targeting Windows computers and once the payload is delivered it locks the PC remotely and asks for money from the user. For those unaware, ransomware is a type of sophisticated malware which locks the system entirely or important files and then blackmails the users to transfer money (via Bitcoins). If the user doesn’t transfer the ransom then the files are usually deleted or the PC may be rendered useless.
CERT-In in its latest advisory warned about the ransomware called Diavol. According to the advisory, thai ransomware is compiled with Microsoft Visual C/C++ Compiler. “It is encrypting files using user-mode Asynchronous Procedure Calls (APCs) with an asymmetric encryption algorithm,” it said.
As per CERT-In, the Diavol malware has been spreading via email, which includes a link to OneDrive. The OneDrive link directs the user to download a zipped file which includes an ISO file containing a LNK file and a DLL. Once opened (mounted) on the user’s system, the LNK file masqueraded as a Document entices the user to click/open it. Once the user executes the LNK file, the malware infection will be initiated.
After the Diavol malware infects a PC, it carries out pre-processing on the victim system including registering the victim device with a remote server, terminating running processes, finding local drives and files in the system to encrypt, and preventing recovery by deleting shadow copies. Then, the files are locked and desktop wallpaper is changed with a ransom message.
“Diavol also lacks any obfuscation as it doesn’t use packing or anti-disassembly tricks, but it still manages to make analysis harder by storing its main routines within bitmap images.
In order to stay safe from this ransomware it is crucial that users update software and operating systems with the latest patches.Scan all incoming and outgoing emails to detect threats and filter executable files from reaching end users.
