February 2018 virus activity review from Doctor Web

February 28, 2018

In February, a ransomware Trojan was spread. This Trojan infects computers running Microsoft Windows. It appends the extension *.GDCB to encrypted files. The final winter month is also marked by the emergence of a miner Trojan for Android. This Trojan can distribute itself on its own, infecting network devices by enabled debugging mode. Smartphones, tablets, media players, routers and “smart” TVs can be infected by the Trojan.

Threat of the month

Doctor Web security researchers detected a ransomware Trojan, Trojan.Encoder.24384. This Trojan is also known as “GandCrab!”, given to this Trojan by cybercriminals. The Trojan encrypts the contents of the fixed, removable and network disks. It also appends the extension *.GDCB to encrypted files. Once launched, under certain circumstances, the encoder checks for anti-virus programs on the infected computer. The Trojan then closes some running programs and installs itself on the system. The programs are specified by cybercriminals.

After restarting the computer, Trojan.Encoder.24384 encrypts files on the disk, except for system directories. We discuss this malicious program’s operating routines in our overview.

According to Dr.Web Anti-virus statistics

Trojan.Moneyinst.520

A malicious program that installs various software, including other Trojans, on a victim's computer.

Trojan.Starter.7394

A Trojan whose main purpose is to launch in an infected system with an executable file possessing a specific set of malicious functions.

Trojan.Zadved

This Trojan displays fake search results in a browser window and imitates pop-up messages from social networking sites. In addition, the malware can replace advertisements displayed on different Internet resources.

Trojan.DnsChange.8268

A malicious program that modifies DNS servers’ addresses on the infected device.

Trojan.Inject

A family of malicious programs that inject malicious code into the processes of other programs.

According to Doctor Web’s statistics servers

JS.Inject

A family of malicious JavaScripts that inject a malicious script into the HTML code of webpages.

Trojan.Starter.7394

A Trojan whose main purpose is to launch in an infected system with an executable file possessing a specific set of malicious functions.

Trojan.DnsChange.8268

A malicious program that modifies DNS servers’ addresses on the infected device.

Trojan.Encoder.11432

A network worm that launches a dangerous ransomware Trojan on a victim’s computer. This Trojan is also known as ‘WannaCry’.

BackDoor.Bebloh

A malicious program belonging to the family of banking Trojans. This application poses a threat to users of e-banking services (RBS), because it allows cybercriminals to steal confidential information by intercepting data submitted through forms in the browser window and by embedding the malicious code into bank webpages.

Statistics concerning malicious programs discovered in email traffic

BackDoor.Bebloh

A malicious program belonging to the family of banking Trojans. This application poses a threat to users of e-banking services (RBS), because it allows cybercriminals to steal confidential information by intercepting data submitted through forms in the browser window and by embedding the malicious code into bank webpages.

JS.Inject

A family of malicious JavaScripts that inject a malicious script into the HTML code of webpages.

Java.Jrat.46

Malware that controls computers remotely (Remote Access Tools, RAT). This malicious program is written in Java.

Trojan.DownLoader

A family of malicious programs designed to download other malware to the compromised computer.

Encryption ransomware

In February, Doctor Web’s technical support was most often contacted by victims of the following modifications of encryption ransomware:

• Trojan.Encoder.858 — 24.33% requests;
• Trojan.Encoder.567 — 8.25% of requests;
• Trojan.Encoder.24249 — 6.19% requests;
• Trojan.Encoder.11539 — 3.92% requests;
• Trojan.Encoder.11464 — 2.68% requests;
• Trojan.Encoder.2667 — 2.67% requests.

Dangerous websites

During February 2018, the number of URLs of non-recommended websites added to the Dr.Web database was 278.9% higher than in the previous month.

Malicious and unwanted programs for mobile devices

In February, security specialists detected a miner Trojan, Android.CoinMine.15. The Trojan can remotely infect Android smartphones, tablets, TVs, routers, and media players connected to the network. The infection is possible only when the devices have the debugging mode enabled. Once the infection has been completed, the malicious program attempts to detect other devices connected to the network and installs its copy on them. Additionally, in the past month, cybercriminals distributed a banking Trojan via Google Play. The Trojan is detected as Android.BankBot.336.origin. This banking Trojan steals confidential information and money from users.

Among the most noticeable February events related to mobile malware were:

• The detection of a miner Trojan that infects Android devices connected to the network;
• The distribution of a new banking Trojan.

Find out more about malicious and unwanted programs for mobile devices in our special overview.