2013-09-12 - Evolution

Revoyem goes international - shocking distribution....

The dirty Revoyem (aka DirtyDecrypt) ransomware seems to have appeared at the end of March 2013 and was targeting Germany and Great Britain only. It looks like they are now going international and are really aggressive in the way they distribute it.

I already mentioned the "double kick the victim" way of distribution of some Ransomware. I saw that in action again today. From a Porn website, you are redirected by a TrafficHolder malvert to a Child Porn themed page (impact 1 : images are highly disturbing here) from which you get infected via Styx which drop you a Ransomware locking your computer displaying disturbing images and telling you just viewed illegal content (impact 2 - amplified cause it's true...you just viewed illegal content even if you've been driven there against your will).

1: Bring the victim to illegal content.
2 : Infect and lock the victim for seeing illegal content

Malwr.com analysis (that i can now link here - thanks Claudio for redacting the design successfully captured)

Nothing really new here but I think it's better to know which countries are targeted.

I made a gathering session and here is the list I saw :

AT, BE, CA, CZ, DE, DK, ES, FR, GB, IT, NL, PL, SE, TR, US

Note : there are quite surely more.

I will only display the US version and banner for countries but blurred full design are available in the zip in case one may want to use for awareness raising purpose.