Pokémon GO for Windows ransomware uncovered
The hack uses AES encryption to lock the files and will then demand the payment
Malware researcher Michael Gillespie has uncovered a ransomware attack that’s disguised as a Pokémon GO app for Windows.
The Hidden-Tear ransomware, which appears to target Arabic-speaking users, encrypts files from Microsoft Office in particular, making them useless unless the victim pays the criminal to unlock them.
After launching, the ransomware sends out the message: “Your files have been encrypted, decoding Falaksa Mobilis following address [email protected] and thank you in advance for your generosity,” in Arabic.
“On closer look, it is apparent that this developer has put in extra time to include features that are not found in many, if any, other ransomware variants,” Lawrence Abrams wrote on Bleeping Computer.
“These features include adding a backdoor Windows account, spreading the executable to other drives, and creating network shares. It also appears that the developer isn’t done yet as the source code contains many indications that this is a development version.”
The backdoor account the ransomware creates allows the hacker to access the user’s computer if they wish in future. It will create a user account named Hack3r, making it an administrator of the host computer. However, this account is hidden, so the user can’t see it in the list of admins.
The ransomware spreads itself by copying the executable file to all removable drives. Whenever a USB drive is plugged into the computer, the ransomware is activated and will make a copy of itself on the root of any fixed disk other then the C: drive, which will then autorun when a user logs into Windows.
Abrams explained it is likely the person behind the ransomware is still developing the tool, because not only are they using a static AES key of 123vivalalgerie (also suggesting the hacker is Algerian), but the hard coded command and control (C2) server the criminal uses is an IP address that is assigned only for private use.