A new data-wiping malware has been detected, infecting more and more endpoints with each passing day - but what's most curious is that it poses as ransomware.
The malware is called Azov Ransomware, and when run on a victim's device, it overwrites file data with junk, rendering the files useless. The overwrites are cyclical - the malware would overwrite 666 bytes of data, then leave the next 666 intact, then repeat the process.
Even though there is no way to retrieve the corrupt files, there is no decryption key or ransom demands, the malware still comes with a ransom note, which says that victims should reach out to security researchers and journalists for help.
Execution trigger
Another curious thing about Azov Ransomware is that it comes with a trigger, having it sit idly on the endpoint until October 27, 10:14:30 AM UTC, after which all hell breaks loose.
When this date comes, the victim doesn’t necessarily need to run the exact executable - running pretty much any program will do. That’s because the wiper will infect all other 64-bit executables on the devices whose file path does not hold these strings:
:\Windows
\ProgramData\
\cache2\entries
\Low\Content.IE5\
\User Data\Default\Cache\
Documents and Settings
\All Users,
In other words, running a seemingly benign program would crash the computer and ruin all of the data on it.
Azov Ransomware is being distributed through the Smokeloader botnet, which is commonly found in fake pirated software and crack sites.
Whoever is behind this wiper, their motives remain unclear. While some researchers think the wiper is used as a cover-up for other malicious behavior, others think the motive is nothing more than to troll the cybersecurity community.
- These are the best firewalls around
Via: BleepingComputer