Karma ransomware

Karma Ransomware, which pretends to be a Windows optimization program called fakeWindows-TuneUp. What is worse is that this sample was discovered as software that would potentially be distributed by a pay-per-install software monetization company when people install free software downloaded from the Internet.
It turns out that this malicious file-encrypting software was distributed (used to, because currently, this ransomware is no longer active because its Command&Control servers were taken down already) along other freeware and presented as recommended additional software that can help the user speed up a slow computer and fix other perfomance-related issues. This malicious program even used to have an official website; however, it is no longer active. Clearly, scammers had put great efforts into making people believe that Windows-TuneUp is a legitimate tool; however, it didn’t take long to realize that in reality it is a Trojan that disseminates Karma ransomware.
When the victim downloads and installs this program, it automatically launches and pretends to be checking the system for errors and problems that need to be fixed. While the victim explores the panel of this fake optimization tool, the virus actually scans system folders and encrypts target files with a sophisticated cipher. The real intention of this PC optimization software emerges when it triggers a ransom note.

windows-tuneup

Files associated with the Karma Ransomware
Windows-TuneUp.exe

Registry entries associated with the Karma Ransomware

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer “auth”
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ “Saffron”= “%Desktop%\\# DECRYPT MY FILES #.html”
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ “Safron”= “%Desktop%\\# DECRYPT MY FILES #.txt”

IOCs:
SHA256: 6545ae2b8811884ad257a7fb25b1eb0cb63cfc66a742fa76fd44bddd05b74fe8
SHA256: cf5fda29f8e1f135aa68620ce7298e930be2cb93888e3f04c9cd0b13f5bc4092

Network Communication:
karma2xgg6ccmupd.onion
windows-tuneup.com/web293/xUser.php

Finally, users of any computing devices should be careful before downloading any software and decline any free software. Also keep a good anti virus program such as Max Total Security and have peace of mind with advance detection and daily data backup (just in case some ransomware makes it to your files!).

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>