Posted by Stu Sjouwerman on Fri, Aug 15, 2014
http://blog.knowbe4.com/Portals/241394/images/torrentlocker.jpgiSIGHT partners discovered a new ransomware strain, which uses components of CryptoLocker and CryptoWall but underneath the surface, the code is completely different from these two earlier ransomware families. They have called this new strain ‘TorrentLocker’.
Despite its unique code, the malware tricks victims into thinking that it's CryptoLocker by copycatting the CryptoLocker ransom message. The design of the ransom page looks more like CryptoWall. The malware installs itself on the infected machine and injects a binary into a legitimate process.
Full Article
New CryptoLocker copycat: TorrentLocker
Userlevel 7
+54
Userlevel 7
+54
September 5th, 2014, 15:07 GMT · By Ionut Ilascu
http://i1-news.softpedia-static.com/images/news-700/TorrentLocker-Ransomware-Aims-At-UK-Users.jpg - Spoofed Royal Mail page
The newly discovered TorrentLocker ransomware with file-encryption capabilities has been observed to target users in UK via spam email purporting to come from Royal Mail postal service.
The messages claim to deliver package tracking information, which is an executable file. The malicious item is downloaded from a phishing website, whose link is provided in the email.
“In August, only Australians were targeted with fake Australian Post package-tracking page”, researchers from ESET security firm say; but as recently as September 2, they found that the operators behind TorrentLocker started a new campaign that focused only on victims from the UK.
Full Article
http://i1-news.softpedia-static.com/images/news-700/TorrentLocker-Ransomware-Aims-At-UK-Users.jpg - Spoofed Royal Mail page
The newly discovered TorrentLocker ransomware with file-encryption capabilities has been observed to target users in UK via spam email purporting to come from Royal Mail postal service.
The messages claim to deliver package tracking information, which is an executable file. The malicious item is downloaded from a phishing website, whose link is provided in the email.
“In August, only Australians were targeted with fake Australian Post package-tracking page”, researchers from ESET security firm say; but as recently as September 2, they found that the operators behind TorrentLocker started a new campaign that focused only on victims from the UK.
Full Article
Userlevel 7
The following article is a update on TorrenLocker
By Darren Pauli, 11 Sep 2014
Crooks have borked the encryption behind the TorrentLocker ransomware, meaning victims can avoid paying the extortionists and unlock their data for free.
TorrentLocker was regarded as the demonic spawn of CryptoLocker and CryptoWall which made killings last year by encrypting valuable data owned by individuals and organisations.
Research trio Taneli Kaivola, Patrik Nisén and Antti Nuopponen of Finnish consultancy Nixu said victims could break the ransomware if they had a plaintext backup of any of their now encrypted files.
"In practice this means that if you have both the original and the encrypted version of a single file that is over 2MB in size, the entire keystream can be recovered which makes it possible to recover all your files encrypted by TorrentLocker," the trio write.
The Register/ full article here/ http://www.theregister.co.uk/2014/09/11/torrentlocker_contains_freeunlock_crypto_shocker/
(TorrentLocker unpicked: Crypto coding shocker defeats extortionists)
By Darren Pauli, 11 Sep 2014
Crooks have borked the encryption behind the TorrentLocker ransomware, meaning victims can avoid paying the extortionists and unlock their data for free.
TorrentLocker was regarded as the demonic spawn of CryptoLocker and CryptoWall which made killings last year by encrypting valuable data owned by individuals and organisations.
Research trio Taneli Kaivola, Patrik Nisén and Antti Nuopponen of Finnish consultancy Nixu said victims could break the ransomware if they had a plaintext backup of any of their now encrypted files.
"In practice this means that if you have both the original and the encrypted version of a single file that is over 2MB in size, the entire keystream can be recovered which makes it possible to recover all your files encrypted by TorrentLocker," the trio write.
The Register/ full article here/ http://www.theregister.co.uk/2014/09/11/torrentlocker_contains_freeunlock_crypto_shocker/
Userlevel 7
+52
TorrentLocker Unlocked
In our analysis, we had samples of both encrypted and plaintext versions of the same files. As the encryption was done by combining the keystream with the plaintext file using the XOR operation, we were able to recover the keystream used to encrypt those files by simply applying XOR between the encrypted file and the plaintext file. We tested this with several samples of the affected files we had and realized that the malware program uses the same keystream to encrypt all the files within the same infection. This was a cryptographic mistake on the malware author's part, as you should never use the keystream more than once.
Further analysis of the encrypted files also revealed that the malware program added 264 bytes of extra data to the end of each encrypted file, and that it only encrypts the first 2MB of the file, leaving the rest intact. If the size of the original file is less then 2MB and if the size is not multiple of 16 bytes, the malware program leaves a few bytes from the end of the file unencrypted (file size modulo 16 to be exact). Only encrypting 2MB from the beginning of the file has probably been a conscious decision of the malware author as it makes it faster to render more files unusable. At the same time it also makes recovering files much easier.
In practice this means that if you have both the original and the encrypted version of a single file that is over 2MB in size the entire keystream can be recovered, which makes it possible to recover all your files encrypted by TorrentLocker.
The exact purpose of the extra 264 bytes that the malware program adds at the end of each file is still unknown, but it seems to be unique for each infection. As it is unique, it allowed us to write a software program that automatically recognizes which keystream has been used to encrypt the files. If the keystream is known then the program can automatically decrypt all the files.
Full Article
Userlevel 7
+54
by Jimmy Nicholls| 18 September 2014 Malware group ‘nearly as successful’ as CryptoLocker authors.
Hackers behind the TorrentLocker ransomware have already patched a decryption bug found only last week, according to security firm iSight Partners.
Victims of previous iterations of the malware could decrypt their files if they had a single unencrypted backup of any of the items affected, since the key to all files could be deduced by applying an XOR cipher between encrypted and plain text files.
Richard Hummel, senior technical intelligence analyst at iSight Partners, said: "TorrentLocker continues to be a notable threat to a wide variety of users, and the number of infections and subsequent payment of Bitcoins suggest that the malware authors are nearly as successful as the actors responsible for CryptoLocker."
Full Article
Hackers behind the TorrentLocker ransomware have already patched a decryption bug found only last week, according to security firm iSight Partners.
Victims of previous iterations of the malware could decrypt their files if they had a single unencrypted backup of any of the items affected, since the key to all files could be deduced by applying an XOR cipher between encrypted and plain text files.
Richard Hummel, senior technical intelligence analyst at iSight Partners, said: "TorrentLocker continues to be a notable threat to a wide variety of users, and the number of infections and subsequent payment of Bitcoins suggest that the malware authors are nearly as successful as the actors responsible for CryptoLocker."
Full Article
Userlevel 7
+54
By Marc-Etienne M.Léveillé posted 16 Dec 2014
Today, we published our research on ransomware that emerged in 2014. We have posted blog articles about this threat before, to raise awareness when we realized the criminals were targeting the United Kingdom and Spain.
Win32/Filecoder.DI, also known as TorrentLocker, encrypts its victims’ valuable documents and demands that the victims pay a ransom so that they can download the decryption software that will unlock their files. Ransomware that encrypts files (also known as Crypto-Ransomware) is not something new. Back in 1989, the infamous AIDS trojan demanded US$189 to access your computer files again. More recently, CryptoLocker gained attention from the media after massive number of victims were observed and the criminals behind the threat were identified. Bromium recently published a report comparing recent crypto-ransomware families, in which TorrentLocker is mentioned.
http://www.welivesecurity.com/wp-content/uploads/2014/12/charts_paid_unpaid.pngRatio of victims who paid the cybercriminals for the decryption software
Full Article
Today, we published our research on ransomware that emerged in 2014. We have posted blog articles about this threat before, to raise awareness when we realized the criminals were targeting the United Kingdom and Spain.
Win32/Filecoder.DI, also known as TorrentLocker, encrypts its victims’ valuable documents and demands that the victims pay a ransom so that they can download the decryption software that will unlock their files. Ransomware that encrypts files (also known as Crypto-Ransomware) is not something new. Back in 1989, the infamous AIDS trojan demanded US$189 to access your computer files again. More recently, CryptoLocker gained attention from the media after massive number of victims were observed and the criminals behind the threat were identified. Bromium recently published a report comparing recent crypto-ransomware families, in which TorrentLocker is mentioned.
http://www.welivesecurity.com/wp-content/uploads/2014/12/charts_paid_unpaid.pngRatio of victims who paid the cybercriminals for the decryption software
Full Article
Userlevel 7
+54
Too many people still running random .exe files in spam attachments
18 Dec 2014 at 10:35, John Leyden
TorrentLocker, one of the most widespread pieces of ransomware, has claimed thousands of victims since it first surfaced in February 2014, according to new research.
Out of 39,670 infected Windows systems, 570 or 1.45 per cent have paid the ransom to criminals to decrypt their locked-up files, according to infosec biz ESET. The crooks behind the scam made between $292,700 (£187k) and $585,401 (£375k) in Bitcoins from these payments.
The ransomware generates a random 256-bit AES key to encrypt documents, pictures and other files on a victim’s PC before demanding up to 4 BTC (about $1,500) from victims; the data is restored if the money is paid.
Full Article
Reply
Login to the community
No account yet? Create an account
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.