Ransomware Now Uses Windows PowerShell

June 2, 2014 – 5:20 AM

We highlighted in our quarterly threat roundup how various ransomware variants and other similar threats like CryptoLocker that now perform additional routines such as using different languages in their warning and stealing funds from cryptocurrency wallets. The addition of  mobile ransomware highlights how these threats are continuously improved over time.

We recently encountered another variant that used the Windows PowerShell feature in order to encrypt files. This variant is detected as TROJ_POSHCODER.A.  Typically, cybercriminals and threat actors have used Windows Powershell to go undetected on an affected system, making detection and analysis harder. However, in this case, using PowerShell made it easier to detect as this malware is also hardcoded. Decrypting and analyzing this malware was not too difficult, particularly compared to other ransomware variants.

Since it uses Powershell, TROJ_POSHCODER.A is script-based, which is not common for ransomware. It uses AES to encrypt the files, and RSA4096 public key cryptography to exchange the AES key. When executed, it adds registry entries, encrypts files, and renames them to {filename}.POSHCODER. It also dropsUNLOCKYOURFILES.html into every folder.

Source:
http://blog.trendmicro.com/trendlabs-security-intelligence/ransomware-now-uses-windows-powershell/