Android adware disguised as game, TV, remote control Apps infects 9 million Google Play users

85 apps in Google Play that collectively have been installed nine million times by users all over the world came with an adware strain capable of showing full screen adverts at regular intervals or when the user unlocks the device.

None of the apps had real functionality and their true purpose was to make money for their developer by dropping a deluge of advertisements on the devices that installed them. The fake apps were disguised as games (car simulators), apps for streaming television channels from various countries (Brazil, Canada, South Africa, Spain), or posed as remote controllers for TV sets.

Google has now removed 85 such Apps. While the apps were uploaded on the Play Store from different developer accounts and were signed by different digital certificates, they exhibited similar behaviors and shared the same code, the most popular of the fraudulent apps was Easy Universal TV Remote, last updated on November 12, 2018. It is unclear how long it survived in Google Play, but it accumulated over five million installations.

Use Max Total Security to remove viruses and adware from all of your Android devices.

Shamoon Disk Wiper Malware returns

The Shamoon or Disttrack worm is a wiper. It is known to overwrite files stored in the affected system and infects its master boot record (MBR). Its first iteration overwrites documents, pictures, videos, and music files, wipes the MBR, and replaces it with an image of a burning flag.

It can overwrite the infected system’s disk with random data or could take the following names (dropped and executed in the system folder as %System%\{wiper name}):

_tdibth.exe
_wialx002.exe
acpipmi2z.exe
af0038bdax.exe
arcx6u0.exe
averfix2h826d_noaverir.exe
hidirkbdmvs2.exe
mdamx_5560.exe
mdmgcs_8.exe
mdmusrk1g5.exe
megasasop.exe
netbxndxlg2.exe
prncaz90x.exe
prngt6_4.exe
prnlx00ctl.exe
prnsv0_56.exe
tsprint_ibv.exe
vsmxraid.exe
wiacnt7001.exe

Shamoon spreads by dropping copies of itself in the system’s administrative shares. The Shamoon worm propagates in these shared network/administrative folders: ADMIN$, C$\WINDOWS, D$\WINDOWS, and E$\WINDOWS.

Users should enforce Patch and update the system to prevent vulnerabilities from being exploited. Regularly back up important data to mitigate damage. Employ multilayered security mechanisms such as application control, firewall and intrusion prevention and detection systems. We receommend using Max Total Security which provides all of these features.

Rotexy Android Trojan Banker and Ransomware

In a three-month period from August to October 2018, it launched over 70,000 attacks against users located primarily in Russia. An interesting feature of this family of banking Trojans is the simultaneous use of three command sources:

Google Cloud Messaging (GCM) service – used to send small messages in JSON format to a mobile device via Google servers;
malicious C&C server;
incoming SMS messages.

It spreads under the name AvitoPay.apk (or similar) and downloads from websites with names like youla9d6h.tk, prodam8n9.tk, prodamfkz.ml, avitoe0ys.tk, etc. These website names are generated according to a clear algorithm: the first few letters are suggestive of popular classified ad services, followed by a random string of characters, followed by a two-letter top-level domain.

After infection, the Trojan displays a fake HTML update page (update.html) that blocks the device’s screen for a long period of time.
The Trojan displays the extortion page (extortionist.html) that blocks the device and demands a ransom for unblocking it. The sexually explicit images in this screenshot have been covered with a black box.
The Trojan displays a phishing page (bank.html) prompting the user to enter their bank card details. This page mimics a legitimate bank form and blocks the device screen until the user enters all the information. It even has its own virtual keyboard that supposedly protects the victim from keyloggers.

According to our data, 98% of all Rotexy attacks target users in Russia. Indeed, the Trojan explicitly targets Russian-speaking users. There have also been cases of users in Ukraine, Germany, Turkey and several other countries being affected.

To avoid such Trojans form landing on your mobile device:

A powerful, updated security solution is a must for all devices you use to shop online. Avoid buying anything online from websites that look potentially dangerous or resemble an incomplete version of a trusted brand’s website.
Don’t click on unknown links in email or social media messages, even from people you know, unless you were expecting the message.

Use Max Total Security for Android devices for total protection.

Emotet Banking Trojan

Emotet Trojan gets on a victim PC by sending an email containing either a malicious link that leads to a downloader document or that has a malicious document attached. Either PowerShell or JavaScript is used to download the Trojan, which delivers a packed payload file to the victim machine. Once on a machine, the latest version of Emotet:

1.Moves itself to its preferred directory
2.Creates a LNK file pointing to itself in the start-up folder
3.Collects victim machine information and sends it to the C&C server
It can then download any new payloads from the C&C server, and execute them. Emotet can download an updated version of itself, or any other threat. Existing versions of Emotet download modules from the C&C server that include:

1.Banking module: This module intercepts network traffic from the browser to steal banking details entered by the user.
2. Email client infostealer module: This module steals email credentials from email client software.
3. Browser infostealer module: This module steals information such as browsing history and saved passwords.
4. PST infostealer module: This module reads through Outlook’s message archives and extracts the sender names and email addresses.

Due to the way Emotet spreads through a company’s network, any infected machine on the network will re-infect machines that have been previously cleaned when they rejoin the network. Therefore, IT teams need to isolate, patch, and remediate each infected system one-by-one. Cleaning an affected network is a procedure that can take a long time—sometimes even months—depending on the number of machines involved.

Admin need to disable Admin$ access. Change all local and administrator passwords.

Max Total Security can detect and remove this Trojan.

Ransomware is slowing down, but not going away

It’s been a busy month for crooks and security researchers alike. Many new variants of Dharma, Kraken, new scarab, Rektware, New IT.Books, Matrix ransomware and mongodb locker were quite active in this month.

New variant of the Dharma ransomware that appends the .brrr or .cmb extension and drops a ransom note named Info.hta that all your files are encrypted. A new variant of the variant Scarab-DiskDoctor ransomware that uses the .mammon extension for encrypted files.

New HiddenTear variant called IT.Books Ransomware that looks like Jigsaw. Drops a ransom note named READ__IT.txt and extension of .f*cked. IT.Books is a high-risk ransomware designed to infiltrate the system and encrypt most of stored data, thereby making it unusable. The created text file and desktop wallpaper contain similar messages saying that data is encrypted and that victim must pay a ransom in order to restore it. Meanwhile, pop-up window states that files are periodically being deleted and that victims must pay a ransom in order to stop the deletion process.

An attack called Mongo Lock is targeting remotely accessible and unprotected MongoDB databases, encrypting them, and then demanding a ransom in order to get the contents back. Mongo db has provided mitigation steps for developer to review these.

A new version, called Kraken Cryptor 1.5, was recently released that is masquerading as the legitimate SuperAntiSpyware anti-malware program in order to trick users into installing it. A new ransomware called Rektware that appends the .CQScSFy extension also came in action.

Users of any computing device must pay close attention when browsing the Internet and downloading/installing/updating software. Always be sure to carefully analyze all email attachments received. If you think that the file is irrelevant or it has been sent by a suspicious/unrecognizable email address, do not open it. Moreover, be sure to download programs only from official sources, using direct download links. Third party downloaders/installers are likely to include rogue/malicious apps, which is why using is not recommended. Users should also keep installed applications updated. To achieve this, however, users should employ only implemented features or tools provided by the official developer. Having a reputable anti-virus/anti-spyware suite installed and running is also paramount. Our recommendation is Max Total Security and we can not emphasize enough Backup , Backup and Backup, use the free Backup / Restore tool provided with the Max Total Security Tools.

Ransomware attack blacks out screens at Bristol Airport

airport-2373727_960_720

Bristol Airport has blamed a “speculative” cyber attack for causing flight information screens to fail for two days.

A spokesman said the displays were taken offline early on Friday as a precautionary measure to contain the attack, which has been described as similar to “ransomware”, with holidaymakers having to read departure times off whiteboards scattered around the airport.

The infection appears to have entered the airport systems on Friday morning (UK time), according to the Bristol Airport social network accounts. The airport authorities warned the passengers all over the weekend of the incident and asked them to arrive early and give additional time for the check-in process.

Throughout the weekend, airport officials resorted to the use of paper posters and white boards to announce the check-in and arrival information of flights passing through the airport between Friday, Saturday and Sunday.

In statements to the local press over the weekend, airport officials mentioned that they did not intend to pay for the ransom requested by the attacker and opted to withdraw their systems while specialists in ethical hacking attended the affected computers.

Bristol authorities confirmed that no flight was affected by this incident. Most of the screens are now back online, including in areas such as departures and arrivals

New AI module in Max Secure Security products

infusing-ai-machine-learnin

With overwhelming more than 100’s of millions new malware every quarter, every Anti-virus company struggles to fight off these. Trying to analyze so much data by an army of human teams of thousands is also not enough. Malware are more sophisticated and releasing new variant every day. We introduced AI (artificial intelligence) module to help solve this problem and identify new attacks as soon as they appear. It analyzes file characteristics to find potential threats as soon as they come in the wild, better known as “Zero day exploits” , which have been profiled in our anti-virus lab.

We are having great success with AI based machine learning and have been able to identify new traces of malware and quarantine them. Using intelligent algorithms we have good control on false positives, a problem mostly encountered by most anti-virus companies while using such generic technology.

So, as suggested always, do not click on emails you do not recognize, do not download from unknown sources and use a good end point security product such as Max Total Security to protect you from all kinds of malware with unbeatable 24×7 technical support team.

PedCont ransomware

Pedcont is a ransomware-type virus that stealthily infiltrates systems. Unlike most other ransomware, Pedcont does not encrypt or rename/modify data in any way, but it does display a pop-up window with a ransom-demand message.

The message states that stored data has been copied to a remote server and that users must pay a ransom of $50 in the Bitcoin cryptocurrency. Once payment is submitted, all stored files are supposedly deleted from the server. If, however, the victim decides not to pay, or payment is not submitted within the given time-frame (72 hours after infiltration), all data is transferred to ‘authorities’. In this way, users are threatened: those who have potentially illegal files may face serious issues. As mentioned above, this behavior is unusual to ransomware-type viruses. This ransomware does not append any specific file extension to the targeted data.

PedCont virus seems to be more of a scareware than a real ransomware because it does not properly encrypt data on the targeted computer. The main purpose of this cyber threat is to trick users that they are criminals who used internet for illegal activities, and now they have to make a payment in order to avoid prosecution.

Soon after the infiltration, PedCont ransomware displays a window on the screen with a threatening message where people can learn what had happened to their files, Criminals use pure psychological terror in order to convince victims into paying the ransom. Paying $50 does not seem as painful as being arrested. However, people standing behind PedCont have nothing in common with legal authorities. This malicious program is created for swindling the money from inexperienced and naive computer users.

pedcont

As soon as PedCont ransomware has infected your computer system, the virus may drop it’s payload files, which in their turn may reside in the following Windows directories:

%AppData%
%Local%
%LocalLow%
%Roaming%
%Temp%

As always, we recommend to not pay any ransom to these companies and use your back up to restore files. Always use Max Total Security to keep all ramsomware away and have peace of mind with automatic back up on local drive, network and on Google Drive.

StalinLocker Ransomware

A new , sophisticated screenlocker / Ransomware has been detected which gives you only 10 minutes to enter code or it locks your screen and starts wiping data on your PC.
stalin

It displays a screen that shows Stalin while playing the USSR anthem and displaying a countdown until files are deleted.

StalinLocker may land on computers via phishing emails and corrupted updates to browser plugins like Adobe Flash and Java. The StalinLocker is a severe threat to PC users as it is designed to wipe data securely if the victim fails to enter a “disarm code” on the Stalin Screen Lock window. Once the StalinLocker Wiper is on the computer, it loads ‘C:\Users\\AppData\Local\stalin.exe’ that covers the screen with a program window completely. As the name implies, the Screen Lock window includes a Photoshopped photo of Josef Stalin after he is appointed as the acting political and military leader of the Soviet Union (USSR). Additionally, it play an MP3 file from ‘C:\Users\\AppData\Local\USSR_Anthem.mp3’.

The Screen Lock message presented to users features the following quote from Josef Stalin:

Translated into English:
‘The victory of socialism in our country is assured
The foundation of the socialist economy is complete
The reality of our production plan is millions of working people who are creating a new life.
J. Stalin.’

A detailed review of the code showed that the StalinLocker Wiper is programmed to give its victims the chance to disable it by entering a code until eleven minutes (660 seconds) are passed. Researchers pointed out that the unlock code is a sequence of numbers. The correct sequence is determined by subtracting 1922.12.30 from the current date. Interestingly, December 30th, 1922 is the date the USSR was established after a revolution took over Russia. If PC users fail to enter the correct disarm code, the StalinLocker Wiper proceeds to delete all data on the local drives starting with drive letter A:\ all the way to Z:\. The StalinLocker Wiper is reported to terminate the processes of the Windows Explorer (explorer.exe) and the Windows Task Manager (taskmgr.exe) when it is loaded on the desktop.

The StalinLocker Wiper does not demand money from users like other Ransomware, and it does not need users to play a game to unlock their files . On the contrary, StalinLocker is a simple data wiper, which can be countered by only one way — backups. We advise PC users to incorporate a reliable backup solution such as provided by Max Total Security.

Cybersecurity Predictions for 2018

cyber-security-1

As BlackBerry’s Chief Security Officer, below are his predictions for 2018:

1. 2018 will be the worst year to date for cyberattacks

With 2017 being the worst year ever for cyberattacks, it’s tempting to think that we’ve hit rock bottom, but what we’ve seen so far is just the tip of the iceberg.

The fundamental issues that have caused the majority of recent cyberbreaches have not been resolved. IT departments are being tasked to manage increasingly complex networks, support new types of endpoints, and protect more and more sensitive data. Legacy systems are still rampant throughout most industries and cannot be easily upgraded or replaced. These systems often contain publicly known software vulnerabilities which can be exploited to penetrate the corporate network.

At the same time, attackers are getting increasingly sophisticated and have more incentives than ever to mount cyberattacks. From building ransomware or mounting DDoS attacks and demanding bitcoin payments, to working with organized crime and even national governments, malicious hackers have numerous ways to monetize their skills and to protect themselves.

2. Cyberattacks will cause physical harm

Securing the Internet of Things is even more important than securing traditional IT networks for one simple reason: IoT attacks threaten public safety. A hacked computer or mobile device typically cannot cause direct physical harm. While it’s certainly frustrating to have our personal information stolen, it doesn’t compare to the impact of being involved in a car accident or having your infusion pump or pacemaker compromised. IoT security will literally become a matter of life and death, and we cannot simply wait for that to happen.

3. Insurance and cybersecurity products will go hand and hand

Firms not only add more cyber policy holders to their roster, but also seek out two strategic avenues to help manage risk for them and their customers: products and experts.

Just like Progressive’s Snapshot plug-in device which helps the insurer provide personalized rates based on your actual driving, insurance companies will start selling products to help track their client’s security posture. They will even partner with security experts to appropriately evaluate a company’s ability to protect against a cyberattack. Scorecards will be given and companies that perform the best will be rewarded with a lower policy amount.

4. Hackers will target employees as they become a growing cybersecurity vulnerability

IT departments typically focus their spending on preventing external attacks, but the reality is that most data breaches start internally – either by sharing documents through unsecure, consumer applications or clicking on increasingly sophisticated phishing attacks.

While hackers are often depicted as technical geniuses using complex algorithms to break advanced cryptography, the reality is that simpler techniques can be just as effective. Criminal hackers aren’t seeking style points; they’re simply looking to breach the system as efficiently as possible. As our technical defenses continue to improve, employees will become the weakest link, increasingly targeted by attackers as part of their overall strategy.

In my opinion, in 2018 companies need to focus on good end point security products, with good essential technical support from vendor and if you do not have enough resources to keep a check on security then outsource to the security vendor who specilizes in detecting new outbreaks and can manage with advanced approach. Try Max Total Security which can fulfill all f your security concerns.