Connect with us

Hi, what are you looking for?

Technology

Magniber ransomware using signed APPX files to infect systems

ransomware


Magniber ransomware is using signed APPX files to infect systems

The Magniber ransomware has been spotted using Windows application package files (.APPX) signed with valid certificates to drop malware pretending to be Chrome and Edge web browser updates.

This distribution method marks a shift from previous approaches seen with this threat actor, which typically relies on exploiting Internet Explorer vulnerabilities.

Browser update notification

The infection begins by visiting a payload dropping website, researchers at Korea cybersecurity company AhnLab note in a report published today.

How victims get to the website, remains unclear. The lure could be delivered via phishing emails, links sent through IMs on social media, or other distribution methods.

Two of the URLs distributing the payload are “hxxp://b5305c364336bqd.bytesoh.cam”, and “hxxp://hadhill.quest/376s53290a9n2j”, but these may not be the only ones.

Visitors to these sites receive an alert to update their Edge/Chrome browser manually, and are offered an APPX file to complete the action.

Alert to download the APPX file
Alert to download the fake Edge update
Source: ASEC

APPX files are Windows application package files created for streamlined distribution and installation, and have been abused by various threats in the past for malware distribution.

In the case of Magniber ransomware, the disguised APPX file is digitally signed with a valid certificate, so Windows sees them as trusted files that do not trigger a warning.

Advertisement. Scroll to continue reading.

The threat actor’s choice to use APPX files is most likely driven by the need to reach a wider audience, since the market share for Internet Explorer is dwindling into extinction.

Dropping the payload

Accepting the malicious APPX file results in creating two files on the “C:Program FilesWindowsApps” directory, namely the ‘wjoiyyxzllm.exe’ and the ‘wjoiyyxzllm.dll’.

DLL code part responsible for downloading and decoding the payload
DLL code part responsible for downloading and decoding the payload
Source: ASEC

These files execute a function that fetches the Magniber ransomware payload, decodes it, and then executes it.

After encrypting the data on the system, the threat creates the following ransom note:

Magniber ransom note dropped onto victims
Magniber ransom note dropped onto encrypted systems
Source: ASEC

Although the note is in English, it is worth noting that Magniber ransomware targets Asian users exclusively these days.

At the moment there is no possibility to decrypt files locked by this malware free of charge.

Unlike most ransomware operations, Magniber did not adopt the double extortion tactic, so it does not steal files before encrypting the systems.

Backing up the data on a regular basis is a good solution to recover from attacks with low-tier ransomware like Magniber.



Source link

Advertisement. Scroll to continue reading.
Click to comment

Leave a Reply

Latest

Top Stories

Various prominent Bitcoin experts, including Adam Back, Jimmy Song and Andreas Antonopoulos, have raised some concerns over the implementation of restrictive covenants, in particular...

Top Stories

FTX founder Sam Bankman-Fried and Alameda Ventures made recent headlines for bailing out a handful of CeFi crypto platforms this week, but what exactly...

Top Stories

Although Bitcoin is struggling to form a bottom, altcoins are on a roll and the current price action could benefit UNI, XLM, THETA and...

Top Stories

Ethereum’s native token Ether (ETH) has declined by more than 35% against Bitcoin (BTC) since December 2021 with a potential to decline further in...

Top Stories

The company enables artists and collectors to create, purchase and resell NFTs via blockchain-enabled transactions. Source link

Technology

Interested in learning what’s next for the gaming industry? Join gaming executives to discuss emerging parts of the industry this October at GamesBeat Summit...

Advertisement

You May Also Like

Uncategorized

Introductions get a lot of attention. I’ve explored the topic of how to write them even though as a reader, I always skip them....

Online Business Success

The internet is now our nervous system. We are constantly streaming and buying and watching and liking, our brains locked into the global information...

SEO Guide

There are all kinds of pictures of the world on the internet, but to find one of these specific pictures that you want to...

Online Business Success

You can think of link building in many ways. I like to call it tedious, painful, and a test of patience. It’s also necessary...

Advertisement