Researchers discovered new Anatova Ransomware which is called as
The ransomware is a turnkey business for some criminals, and victims still pay the ever-increasing demands for ransom, it’s become a billion-dollar industry that shows no signs of going away anytime soon.
In this case, researchers used the term called “modular” for Anatova Ransomware, which means, The ransomware using many different ways to infect the victims with the ultimate motivation of encryption data.
Based on the Anatova ransomware structure, Malware authors are highly skilled and
Anatova is one of the distractive Ransomware with high intelligence futures and unlike other ransomware, it doesn’t add any file extension after complete the encryption process.
Also Read: New Mongolock Ransomware Attacking Database to Encrypt & Deleting Files
Anatova Ransomware Infection Process
Initially, the Anatova Ransomware delivering through in various medium such as weaponized doc or PDF, social media, and spam emails.
Once it entered into the system, it starts using the intelligence and evasion techniques and
later It starts the encryption process and encrypts the all the disk files except the files that exist in the important folder such as ‘windows’, ‘program files’, ‘program files(x86)’,’boot’ etc. which helps to run the OS.
During the encryption process, Anatova Ransomware terminates the encryption process of associated files of the
| msftesql.exe | agntsvc.exeisqlplussvc.exe | ocomm.exe | onenote.exe |
| sqlagent.exe | xfssvccon.exe | mysqld.exe | outlook.exe |
| sqlbrowser.exe | mydesktopservice.exe | mysqld-nt.exe | powerpnt.exxe |
| sqlwriter.exe | ocautoupds.exe | mysqld-opt.exe | steam.exe |
| sqlservr.exe | agntsvc.exeagntsvc.exe | dbeng50.exe | thebat.exe |
| ocssd.exe | agntsvc.exeencsvc.exe | sqbcoreservice.exe | thebat64.exe |
| oracle.exe | firefoxconfig.exe | excel.exe | thunderbird.exe |
| dbsnmp.exe | tbirdconfig.exe | infopath.exe | visio.exe |
| synctime.exe | mydesktopqos.exe | msaccess.exe | |
| winword.exe | wordpad.exe | mspub.exe |
Also, it skips the some of the file extensions that are existing in the important locations such as ‘windows’, ‘program files’, ‘program files(x86)’,’boot’ etc and some few file extension such as
According to Quick Heal Research, “Smartly, this ransomware encrypts files whose size is =<1MB, and if the size is more than 1 MB then it will only encrypt the data of 1 MB from that file, we suspect that it does it to take lesser time for encryption and to avoid the detection from the security software.”
During the encryption process it using a combination of RSA and Salsa 20 Algorithm that helps not to encrypt the
Anatova Ransomware not only encrypt the infected host but also it checking the remote network location and its delete the shadow copy once it
Later its drops the ransom notes into infected victims desktop that contains the complete information about ransom payment and decryption process steps.
After encryption, Anatova demands ransom payment in cryptocurrency of 10 DASH which calculates to somewhere around $700 USD, Researchers said.
