cursoDFIR Ransomware Contains Ransom Note in Portuguese
While examining new malware samples, we came across cursoDFIR, a type of ransomware designed to encrypt files. Moreover, cursoDFIR adds its extension (".cursoDFIR") to filenames, alters the desktop background, and generates a text document ("meleaicara.txt") containing a ransom message.
An illustration of how cursoDFIR renames encrypted files: "1.jpg" becomes "1.jpg.cursoDFIR", "2.png" transforms into "2.png.cursoDFIR", and so on. This ransom message, composed in Portuguese, demands payment in exchange for decrypting the files that cursoDFIR has locked. It accuses the victim of attempting to download pirated Microsoft software and stipulates payment in digital currency to obtain the decryption key.
It's important to highlight that this ransom message lacks any contact details, which deviates from the norm for ransomware demands. Typically, such messages include instructions for victims to reach out to the cybercriminals to discuss the ransom payment and obtain decryption assistance.
cursoDFIR Ransom Note Composed in Portuguese
The full text of the very brief ransom note generated by cursoDFIR reads as follows:
ESTE RANSOMWARE FOI PARA VOCÊ!
É VOCÊ MESMO QUE TENTOU BAIXAR UM MICROSOFT PIRATA!
PARA DESCRIPTOGRAFAR PRECISA PAGAR
PAGAR 1 MOEDA DIGITAL
Key: EC63E8BE0717BD92C0FFBF7A21749A54
CURSO DE DFIR Mente Binária
Professor: Caique
How Can Ransomware Infect Your Computer?
Ransomware can infect your computer through various methods, including:
Phishing Emails: One of the most common methods is through phishing emails. Cybercriminals send deceptive emails containing malicious attachments or links. When unsuspecting users open these attachments or click on the links, the ransomware is downloaded and executed on their systems.
Malicious Websites: Visiting compromised or malicious websites can also lead to ransomware infections. These websites may contain exploit kits that automatically download and install ransomware onto visitors' computers by exploiting vulnerabilities in their browsers or plugins.
Drive-By Downloads: Similar to malicious websites, ransomware can be downloaded onto your computer without your knowledge through drive-by downloads. These downloads occur when you visit a legitimate website that has been compromised, and malware is automatically downloaded and installed onto your system in the background.
Vulnerable Software: Ransomware can exploit vulnerabilities in software installed on your computer, such as operating systems, web browsers, or plugins. Cybercriminals exploit these vulnerabilities to gain unauthorized access to your system and deploy ransomware.
Malicious Advertisements (Malvertising): Ransomware can also be distributed through malicious advertisements displayed on legitimate websites. Clicking on these ads can lead to the automatic download and installation of ransomware onto your computer.
