Scareware Morphs Into Ransomware

Researchers at security vendor FireEye have discovered that malware formerly used to push "scareware" is now being used to push "ransomware."

According to a FireEye blog, the malware known as Vundo is now infecting users with an exploit that encrypts the data on a PC and then requests $40 for the key to decrypt it.

Vundo has been infecting PCs for some time, but previously was used to scare users into downloading fake, "rogue" security software, such as XPAntiVirus2009, by telling them their PCs had been infected. Users who downloaded the bogus antivirus tool were infected with a variety of malware.

"Vundo has fundamentally altered its criminal business model from 'scareware' tactics to 'ransomware' extortion," blogs Alex Lanstein of FireEye's Malware Intelligence Lab. "While a user may be 'silly' to buy into scareware, they have little choice but to purchase the decryption software once the ransomware does its thing."

FireEye describes Vundo as a "generic Trojan" that sends a popup to Web users. In this case, however, Vundo is "pushing a piece of malware that encrypts various personal file types (.pdf, .doc, .jpg, etc.) on your system, and 'coincidentally' pushes a program called FileFix Pro 2009, which would decrypt them -- for a fee."

After studying the malware, FireEye developed a Perl script that will decrypt the files minus a fee. Users can upload their infected files to the the FileFix File Decrypter and receive back readable files. "In the coming days we'll be releasing a tool you can download that will decrypt all the affected files on your system," Lanstein blogs.

So far, none of the antivirus tools tested have been able to detect or eradicate the Vundo-borne malware because it is "polymorphic" and appears as a different executable file each time, FireEye says.

FireEye is not sure who is distributing the malware, but a "whois" on the IP address of FileFixPro.com shows it's hosted at ThePlanet and registered to an organization out of the Ukraine, Lanstein says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message