JNEC.a Ransomware Spread by WinRAR Ace Exploit
A new ransomware called JNEC.a spreads through an exploit for the recently reported code execution ACE vulnerability in WinRAR. After encrypting a computer, it will generate a Gmail address that victims need to create in order to receive the file decryption key once they pay the ransom.
Once executed, the ransomware encrypts data on the computer and appends the .Jnec extension to the file’s original one. The price for the decryption key is 0.05 bitcoins (about $200). The interesting part is that the malware author chose an unusual method to deliver the file decryption keys. The ID number unique for each affected computer represents a Gmail address for the delivery of the key.
Although the address is available in the ransom note, it is not registered yet. This task falls in the hands of the victim if they want to recover their files after paying the ransom. Just to make sure that the victims understand how they can recover their data, the malware author also provides clear instructions about creating specific Gmail address; these are available in a JNEC.README.TXT ransom note that the ransomware drops on an infected computer.
JNEC.a is written in .NET and falling for it starts with extracting the contents of the rigged archive. A corrupt image of a girl is inside which, when decompressed, triggers and error and shows an incomplete picture. The error and the picture fragment make everything seem like a technical fault, so the user won’t give it another thought. However, the ransomware is already added to the system.
The WinRAR exploit enables the author to drop the malware into the Windows Startup folder, so it deploys on the next login. To hide its presence, the author named it “GoogleUpdate.exe,” so it is easily mistaken for Google’s update process. Exploiting the WinRAR vulnerability is not difficult. After Check Point published their analysis for the flaw, proof-of-concept code emerged online. Swiftly after, a script that automated the creation of a malicious archive with arbitrary payloads appeared on GitHub.
Last week, McAfee reported that in the week following the vulnerability disclosure more than 100 unique exploits were identified, and the number kept growing. At the moment of writing, 29 antivirus engines detect JNEC.a as threat. The ransomware encrypts files in their entirety, which could be the reason we saw it move slowly during our tests.