Pokémon GO for Windows ransomware uncovered

The hack uses AES encryption to lock the files and will then demand the payment

Malware researcher Michael Gillespie has uncovered a ransomware attack that's disguised as a Pokmon GO app for Windows.

The Hidden-Tear ransomware, which appears to target Arabic-speaking users, encrypts files from Microsoft Office in particular, making them useless unless the victim pays the criminal to unlock them.

After launching, the ransomware sends out the message: "Your files have been encrypted, decoding Falaksa Mobilis following address me.blackhat20152015@mt2015.com and thank you in advance for your generosity," in Arabic.

"On closer look, it is apparent that this developer has put in extra time to include features that are not found in many, if any, other ransomware variants," Lawrence Abrams wrote on Bleeping Computer.

Advertisement
Advertisement - Article continues below

"These features include adding a backdoor Windows account, spreading the executable to other drives, and creating network shares. It also appears that the developer isn't done yet as the source code contains many indications that this is a development version."

The backdoor account the ransomware creates allows the hacker to access the user's computer if they wish in future. It will create a user account named Hack3r, making it an administrator of the host computer. However, this account is hidden, so the user can't see it in the list of admins.

The ransomware spreads itself by copying the executable file to all removable drives. Whenever a USB drive is plugged into the computer, the ransomware is activated and will make a copy of itself on the root of any fixed disk other then the C: drive, which will then autorun when a user logs into Windows.

Abrams explained it is likely the person behind the ransomware is still developing the tool, because not only are they using a static AES key of 123vivalalgerie (also suggesting the hacker is Algerian), but the hard coded command and control (C2) server the criminal uses is an IP address that is assigned only for private use.

Featured Resources

The essential guide to cloud-based backup and disaster recovery

Support business continuity by building a holistic emergency plan

Download now

Trends in modern data protection

A comprehensive view of the data protection landscape

Download now

How do vulnerabilities get into software?

90% of security incidents result from exploits against defects in software

Download now

Delivering the future of work - now

The CIO’s guide to building the unified digital workspace for today’s hybrid and multi-cloud strategies.

Download now
Advertisement

Recommended

Visit/security/29204/how-can-you-protect-your-business-from-crypto-ransomware
Security

How can you protect your business from crypto-ransomware?

4 Nov 2019
Visit/security/ransomware/28070/best-ransomware-removal-tools
Security

Best ransomware removal tools

7 Dec 2018
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/business-strategy/digital-transformation/354201/boston-dynamics-dog-like-robots-sniff-out-bombs-for
digital transformation

Boston Dynamics dog-like robots sniff out bombs for Massachusetts police

26 Nov 2019
Visit/business-strategy/mergers-and-acquisitions/354191/xerox-threatens-hostile-takeover-after-hp-rebuffs
mergers and acquisitions

Xerox threatens hostile takeover after HP rebuffs $30bn takeover

22 Nov 2019
Visit/security/data-breaches/354192/t-mobile-data-breach-affects-more-than-a-million-users
data breaches

T-Mobile data breach affects more than a million users

25 Nov 2019
Visit/mobile/google-android/354189/samsung-galaxy-a90-5g-review-simply-the-best-value-5g-phone
Google Android

Samsung Galaxy A90 5G review: Simply the best value 5G phone

22 Nov 2019