Pierluigi Paganini April 22, 2018

Researchers at MalwareHunterTeam have discovered a new strain of ransomware called RansSIRIA that encrypts victim’s files and then states it will donate the ransom to Syrian refugees.

Unscrupulous cybercriminals try to exploit every situation, even the most dramatic incidents. In the past, crooks attempted to exploits the media attention on dramatic events such as the Boston Marathon, the MH17, and the Hurricane Matthew Marathon.

Now security experts at MalwareHunterTeam have discovered a new strain of ransomware called RansSIRIA that encrypts victim’s files and then states it will donate the ransom to Syrian refugees.

So, there is a "WannaPeace RansSIRIA" ransomware.
No comment…@BleepinComputer @demonslay335 pic.twitter.com/lRczsCAwqB

— MalwareHunterTeam (@malwrhunterteam) April 19, 2018

According to the experts, the RansSIRIA ransomware is a variant of the WannaPeace ransomware the campaign spotted by the researchers aimed at Brazilian users.

Once the ransomware is executed, it will display a fake Word window while the malware encrypts victim’s files.

When the encryption process is completed, the ransomware will display a ransomware note containing the instructions for the payment.

Source bleepingcomputer.com

The ransom note also contains a singular message to explain the ransom will be used to help Syrian refugees.

The ransom note is written in Portuguese, below the translated text was published by experts at BleepingComputer:

Sorry, your files have been locked

Please introduce us as Anonymous, and Anonymous only.
We are an idea. An idea that can not be contained, pursued or imprisoned.
Thousands of human beings are now ruled, wounded, hungry and suffering ...
All as victims of a war that is not even theirs !!!
But unfortunately only words will not change the situation of these human beings ...
We DO NOT want your files or you harm them ... we only want a small contribution ...
Remember .. by contributing you will not only be recovering your files ...
... but helping to restore the dignity of these victims ...

Contribute your contribution from only: Litecoins to wallet / address below.

The ransomware will show a gallery of cruel images that show the dramatic situation in Syria and will play a YouTube video of the “Save the Children” organization that shows the suffering of Syrian children and the effect of a stupid war that someone don’t want to stop.

If the victims chose to pay the ransom, the malware will decrypt the files and then open the short URL https://goo.gl/qNxDFP, that is the Google-translated version of the article published at Worldvision about Syrian refugee children.

Statistics on the short URL shows the RansSIRIA ransomware was created on March 15th and at the time of writing it was opened 64 times, a circumstance that suggests that the threat is currently not widespread.

Unfortunately, ransom paid by the victims will never support the Syrian refugees.

Pierluigi Paganini

(Security Affairs – RansSIRIA ransomware, cybercrime)

[adrotate banner=”5″]

[adrotate banner=”13″]