New Rampant Strain Of Ransomware Emerges: VirRansom
By Christine Kern, contributing writer
A new hybrid ransomware has emerged: VirRansom. Earlier this month, SophosLabs reported the virus, blocked by Sophos as W32/VirRnsm-A, not only infects .exe files, but also data files like .zip, .doc, and .jpg. Furthermore, the virus sets the icon of the infected file to what it was prior, so you could unknowingly open an infected file — it looked just like it did before.
KnowBe4 CEO Stu Sjouwerman also point out this one is “a true self-replicating parasitic virus.” He provides some details about the hybrid strain that combines CryptoLocker and http:// CryptoWall functions: “This ransomware threat utilizes both ransomware and parasitic virus features. VirRansom is a full-fledged virus which will spread across your network and doing a less than perfect job on the disinfection can easily lead to reinfection of your whole network. CryptoWall-encrypted files that you can't or don't decrypt are harmless garbage forever, but you can delete those. However, with VirRansom, files that you don’t decrypt are still recoverable, but remain actively infectious.”
SophosLabs reports this ransomware installs itself permanently to a hard disk, sets a registry entry to run after you logout or reboot, and activates itself by loading processes into memory. Once a system is infected, it looks for more files to infect and runs two processes that restart each other — it also launches a pay page to demand ransom.
Sophos Anti-Virus is able to decrypt the keys to eliminate your need to pay a ransom, but files you don’t decrypt, although recoverable are “still actively infectious.”
Sjouwerman cautions, “Ransomware gets nastier all the time. We can expect a VirRansom 2.0 with ‘new features’ like industrial-strength CryptoWall-like encryption where files are held hostage until payment is made and email server infections where emails are converted to a worm for maximum dissemination of their malicious code. The legal ramifications could be horrific.”
Sjouwerman suggests the following measures to mitigate risks from these attacks:
- Test the restore function of backups and have a full set of backups offsite.
- Start thinking about asynchronous real-time backups so you can restore files with a few mouse clicks.
- Get rid of mapped drives and use UNC (universal naming convention) links for shared folders.
- Look into whitelisting software that only allows known-good executables to run.
- Update or enforce security policy best practices, such as thorough effective security awareness training to prevent these types of infections to begin with.