Pokémon GO for Windows ransomware uncovered

The hack uses AES encryption to lock the files and will then demand the payment

Malware researcher Michael Gillespie has uncovered a ransomware attack that's disguised as a Pokmon GO app for Windows.

The Hidden-Tear ransomware, which appears to target Arabic-speaking users, encrypts files from Microsoft Office in particular, making them useless unless the victim pays the criminal to unlock them.

After launching, the ransomware sends out the message: "Your files have been encrypted, decoding Falaksa Mobilis following address me.blackhat20152015@mt2015.com and thank you in advance for your generosity," in Arabic.

"On closer look, it is apparent that this developer has put in extra time to include features that are not found in many, if any, other ransomware variants," Lawrence Abrams wrote on Bleeping Computer.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"These features include adding a backdoor Windows account, spreading the executable to other drives, and creating network shares. It also appears that the developer isn't done yet as the source code contains many indications that this is a development version."

The backdoor account the ransomware creates allows the hacker to access the user's computer if they wish in future. It will create a user account named Hack3r, making it an administrator of the host computer. However, this account is hidden, so the user can't see it in the list of admins.

The ransomware spreads itself by copying the executable file to all removable drives. Whenever a USB drive is plugged into the computer, the ransomware is activated and will make a copy of itself on the root of any fixed disk other then the C: drive, which will then autorun when a user logs into Windows.

Abrams explained it is likely the person behind the ransomware is still developing the tool, because not only are they using a static AES key of 123vivalalgerie (also suggesting the hacker is Algerian), but the hard coded command and control (C2) server the criminal uses is an IP address that is assigned only for private use.

Featured Resources

Digital Risk Report 2020

A global view into the impact of digital transformation on risk and security management

Download now

6 ways your business could suffer if you don’t backup Office 365

Office 365 makes it easy to lose valuable data regularly, unpredictably, unintentionally, and for good

Download now

Get the best out of your workforce

7 steps to unleashing their true potential with robotic process automation

Download now

8 digital best practices for IT professionals

Don't leave anything to chance when going digital

Download now
Advertisement

Recommended

Visit/security/29204/how-can-you-protect-your-business-from-crypto-ransomware
Security

How can you protect your business from crypto-ransomware?

4 Nov 2019
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/mobile/28299/how-to-use-chromecast-without-wi-fi
Mobile

How to use Chromecast without Wi-Fi

5 Feb 2020
Visit/operating-systems/27717/how-to-fix-a-stuck-windows-10-update
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020
Visit/security/34616/the-top-ten-password-cracking-techniques-used-by-hackers
Security

The top ten password-cracking techniques used by hackers

10 Feb 2020
Visit/security/cyber-security/354827/mcafee-researchers-trick-tesla-autopilot-with-a-strip-of-tape
cyber security

McAfee researchers trick Tesla autopilot with a strip of tape

21 Feb 2020