Blog

Ransomware is confirmed by disguised as a Pokemon GO Windows version app that encrypts files and take a hostage.

× Security

「Windows版Pokémon GO(ポケモンGO)」という存在しない偽アプリが開発され、本物のポケモンGOアプリだと勘違いしてインストールした人がランサムウェアに感染、被害者が端末のデータにアクセスできないようにして身代金を脅迫するという事態が報告されています。ポケモンGOランサムウェアは、これまでに報告されてきた一般的なランサムウェアとは異なる挙動をしているとのこと。PokemonGo Ransomware installs Backdoor Account and Spreads to other Driveshttp://www.BleepingComputer.com/news/security/pokemongo-ransomware-installs-backdoor-accounts-and-spreads-to-other-drives/このランサムウェアは、セキュリティ研究者のMichael Gillespie氏によって発見されたもの。アプリのアイコンはこんな感じです。

Ransomware infected with the victim's device first scans the terminal to find out if the following extension files are included.

そして、これらのファイルをAESで暗号化し、さらに暗号化されたファイルに「.Added an extension called "Locked".Make sure that users cannot access the terminal file.Then, when the work is completed, it will show you how to pay the ransom if you want to access the data of this terminal, so please contact us to "[Email Protected]".Many of the ransomware reported in the past used to encrypt data, delete, and then display the threats.However, it is normal for Pokemon GO's ransomware to display the intimidation content without deleting the data and only encrypts it.Also, when infected, it is different from the other to create a backdoor in the Windows device, which allows the ransomware creator to access the victim's terminal again at a later date.If the ransomware of Pokemon GO is infected with the following feeling, a user account called "HACK3R" will be added to the Administrators Group on the terminal.At this time, the HACK3R account is hidden so that it is invisible from the Windows login screen.

One of the unique points of Pokemon GO's ransomware is to create a network sharing on the victim's computer.However, this network sharing is not used at the time of article creation, and its purpose is unknown.

In addition, Pokemon GO Ransomware will try to copy your own executable to a remover drive."Autorun" is "Autorun.A file called INF is created, and the moment you connect a drive to another computer, another computer is infected with ransomware, trying to expand the infection one after another.Then, when you copy from an external drive to a computer C drive, the Pokemongo ransomware is automatically called when the user tries to log in to the Windows account.The target of Pokemon GO discovered this time is the people in the Arab area from the language used in threatening sentences.The following is a intimidation document, and when translated, "Your file has been encrypted. Contact" [Email Protected] "to encrypt it. Thank you for your generosity in advance.I'll leave. "

And when the victim user logs in to Windows, the following screen saver will be displayed.

ポケモンGOのWindows版アプリに偽装してファイルを暗号化し人質に取るランサムウェアが確認される

The "123VIVALALGERIE" of the AES password means "Algeria Hundred", the language of Arab and French in the program, "Sans Titre" written in the screen saver program is the French "UNTITLED".(Untitled) "is expected to be Ransomware developers as Algerians.In addition, from the features described above, Pokemon GO ransomware is still in the stage of "under development", and it is unknown how much infection will be expanded.In the future, it is necessary to be careful when downloading and installing Pokemon GO -related apps.

この記事のタイトルとURLをコピーする

・関連記事大人気の「ポケモンGO(Pokémon GO)」が月額有料制になるというスパムメールが出回る - GIGAZINE世界で初めてポケモンGOが禁止される国が登場 - GIGAZINEポケモンGO開発元・NianticのCEOのTwitterアカウントがハッキングされる - GIGAZINEポケモンGOを外に出ずイスに座ったままプレイ可能になるGPSハッキングムービー - GIGAZINE「ポケモンGO(Pokémon GO)のサーバーをダウンさせる」とハッカー集団が予告、丸1日Pokemon GOがプレイできない可能性も - GIGAZINEポケモンGOがどうやって世界中の至る所にポケモンを出現させているのかがわかる衝撃のムービー - GIGAZINE

・ Related content

Tweet

in software, security, posted by logq_fa

You Can Read The Machine Translated English Article Here Here Here Here.

Hot Articles

How to Save Websites as PDF on iPhone or PC | Business Insider Japan

How to Save Websites as PDF on iPhone or PC | Business Insider Japan

Sign up for a free e-mail newsletter We'll send you a Business Insider Japan e-mail newsletter at 17:00 on weekdays. Check the terms of use You can save the website as a PDF from various web browsers including Safari on iPhone. Photo: Takuma Imamura Web page suddenly ...

READ MORE READ MORE
Yahoo! News Digitalizing the traditional "small pattern dyeing" pattern Crisis of disappearance, challenge of long-established president

Yahoo! News Digitalizing the traditional "small pattern dyeing" pattern Crisis of disappearance, challenge of long-established president

In the file in front of Mr. Atsushi Tomita, a well-preserved paper pattern is included so that it is not exposed to the air as much as possible. To prepare for digitization and prevent deterioration = Taken by Hiroyuki Kondo on the morning of December 10, 2021 at Tomita Dyeing Crafts in Shinjuku-ku, Tokyo ...

READ MORE READ MORE
 It's okay if you forget to record the news!How to see the famous scenes of the Olympics later on your smartphone

It's okay if you forget to record the news!How to see the famous scenes of the Olympics later on your smartphone

Explaining how to use the archive distribution The Tokyo Olympics attracts attention not only for players' play but also for unique commentary. Even if you miss it even though it became a hot topic, or if you did not record it, you can do it at your favorite timing later ...

READ MORE READ MORE

Related Articles