This rather odd ransomware deletes your data just a few bytes at a time

Date:
Tue, 08 Nov 2022 15:38:20 +0000

Description:
Azov Ransomware replaces every other 666 bytes of data with junk, rendering the entire device useless

FULL STORY ======================================================================

A new data-wiping malware has been detected, infecting more and more
endpoints with each passing day - but what's most curious is that it poses as ransomware .

The malware is called Azov Ransomware, and when run on a victim's device, it overwrites file data with junk, rendering the files useless. The overwrites are cyclical - the malware would overwrite 666 bytes of data, then leave the next 666 intact, then repeat the process.

Even though there is no way to retrieve the corrupt files, there is no decryption key or ransom demands, the malware still comes with a ransom note, which says that victims should reach out to security researchers and journalists for help. Execution trigger

Another curious thing about Azov Ransomware is that it comes with a trigger, having it sit idly on the endpoint until October 27, 10:14:30 AM UTC, after which all hell breaks loose.

When this date comes, the victim doesnt necessarily need to run the exact executable - running pretty much any program will do. Thats because the wiper will infect all other 64-bit executables on the devices whose file path does not hold these strings: Read more

These are the best antivirus programs out there

Ransomware posing as Windows antivirus update will just empty your wallet

What is ransomware and how does it work?

:\Windows

\ProgramData\

\cache2\entries

\Low\Content.IE5\

\User Data\Default\Cache\

Documents and Settings

\All Users,

In other words, running a seemingly benign program would crash the computer and ruin all of the data on it.

Azov Ransomware is being distributed through the Smokeloader botnet, which is commonly found in fake pirated software and crack sites.

Whoever is behind this wiper, their motives remain unclear. While some researchers think the wiper is used as a cover-up for other malicious behavior, others think the motive is nothing more than to troll the cybersecurity community. These are the best firewalls around

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/this-rather-odd-ransomware-deletes-your-data-ju st-a-few-bytes-at-a-time/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)