Pokémon GO for Windows ransomware uncovered

The hack uses AES encryption to lock the files and will then demand the payment

Malware researcher Michael Gillespie has uncovered a ransomware attack that's disguised as a Pokmon GO app for Windows.

The Hidden-Tear ransomware, which appears to target Arabic-speaking users, encrypts files from Microsoft Office in particular, making them useless unless the victim pays the criminal to unlock them.

After launching, the ransomware sends out the message: "Your files have been encrypted, decoding Falaksa Mobilis following address me.blackhat20152015@mt2015.com and thank you in advance for your generosity," in Arabic.

"On closer look, it is apparent that this developer has put in extra time to include features that are not found in many, if any, other ransomware variants," Lawrence Abrams wrote on Bleeping Computer.

Advertisement - Article continues below

"These features include adding a backdoor Windows account, spreading the executable to other drives, and creating network shares. It also appears that the developer isn't done yet as the source code contains many indications that this is a development version."

The backdoor account the ransomware creates allows the hacker to access the user's computer if they wish in future. It will create a user account named Hack3r, making it an administrator of the host computer. However, this account is hidden, so the user can't see it in the list of admins.

Advertisement
Advertisement - Article continues below

The ransomware spreads itself by copying the executable file to all removable drives. Whenever a USB drive is plugged into the computer, the ransomware is activated and will make a copy of itself on the root of any fixed disk other then the C: drive, which will then autorun when a user logs into Windows.

Abrams explained it is likely the person behind the ransomware is still developing the tool, because not only are they using a static AES key of 123vivalalgerie (also suggesting the hacker is Algerian), but the hard coded command and control (C2) server the criminal uses is an IP address that is assigned only for private use.

Advertisement

Recommended

Visit/security/29204/how-can-you-protect-your-business-from-crypto-ransomware
Security

How can you protect your business from crypto-ransomware?

4 Nov 2019
Visit/security/cyber-security/355185/165-million-britons-experienced-a-cyber-crime-in-the-past-year
cyber security

Report: 16.5 million Britons fell victim to cyber crime in the past year

1 Apr 2020
Visit/cloud/amazon-web-services-aws/355183/aws-launches-amazon-detective
Amazon Web Services (AWS)

AWS launches Amazon Detective for investigating security incidents

1 Apr 2020
Visit/security/privacy/355182/government-to-launch-coronavirus-contact-tracking-app
privacy

UK government to launch coronavirus 'contact tracking' app

1 Apr 2020

Most Popular

Visit/security/privacy/355211/google-releases-location-data-to-showcase-effectiveness-of-coronavirus
privacy

Google releases location data to show effectiveness of coronavirus lockdowns

3 Apr 2020
Visit/data-insights/data-management/355170/oracle-cloud-courses-are-free-during-coronavirus-lockdown
data management

Oracle cloud courses are free during coronavirus lockdown

31 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

2 Apr 2020