#Lite wallet bitmessage zip file#
#Lite wallet bitmessage archive#
#Lite wallet bitmessage code#

#Lite wallet bitmessage code#

After de-obfuscation and function renaming, the same section of code becomes much easier to read. If we restore the line breaks and indents, it becomes obvious that the obfuscation involves renamed variables and functions, as well as strings hidden in the global array. The content of the script looks like this in the source code: The code of the malicious script was deliberately obfuscated to complicate things for malware analysts.

#Lite wallet bitmessage archive#

To unpack an archive like this, the anti-malware product must automatically retrieve the password from the message, which isn’t always possible.įor an infection to occur, users have to unpack the archive themselves and launch the. It should be noted that sending malicious content in a password-protected archive is a well-known trick used by cybercriminals to prevent anti-malware systems installed on mail servers from unpacking the archive and detecting any malicious content.

People who know what ‘asymmetric encryption’ is will probably just smile at this however, the message is obviously targeting a different audience. Dear client, your password for this message is 111.” “The company… notifies you that in line with internal security regulations, all outgoing emails are subject to asymmetric encryption. Please make all the payments in next few days.” “We understand you may have difficulties, but do we have to wait for another two months? To be honest, we don’t really want to go to court. “Let’s presume we made a concession when we allowed you to postpone your due payment. The attack is aimed primarily at corporate users: the message mimics finance-related business correspondence, and the script’s name is similar to those shown below:

#Lite wallet bitmessage zip file#

The malicious script is sent to potential victims attached to a spam message in a ZIP file with the password ‘111’. The body of this new version of RAA is a script in JScript (with a. Let’s have a closer look at this particular sample, which has been assigned the verdict Trojan-Ransom.JS.RaaCrypt.ag. We recently detected a new version of this Trojan that has a few differences from earlier known modifications. It caught the attention of researchers and analysts due to the fact that it was written entirely in JavaScript, which is a rarity when it comes to ransomware cryptor Trojans. The RAA cryptor (Kaspersky Lab verdict: Trojan-Ransom.JS.RaaCrypt) was first detected in June 2016. In this article, we will provide details of how a pair of malicious programs – a new version of the RAA cryptor and the Pony stealer Trojan – work in unison. This substantially improves the probability of subsequent infections. We can assume that the owners of RAA use these resources to carry out targeted attacks – sending out emails with the cryptor malware to the addresses on the victim’s contact list. Using the stolen data, the cybercriminals can gain access to the victim’s mail clients and other resources. However, it doesn’t stop there: some versions of RAA also include a Pony Trojan file, which steals confidential information from the infected computer. After a successful infection, RAA executes its main task, i.e. The Trojan is delivered in emails that mostly target corporate users. The owners of the RAA cryptor, however, took a different tack. The bot can then be used by cybercriminals to steal money, a much more profitable outcome than just receiving a ransom to decrypt some files. For example, one version of the Shade cryptor checks victim computers for signs of accounting activity if it finds any, it doesn’t encrypt the files, but instead installs remote control tools in the infected system. We have already seen some cryptor attacks where malicious programs with different functions have been used in combination.