<div dir="ltr"><a href="http://news.softpedia.com/news/fbi-and-microsoft-warn-of-samas-ransomware-501914.shtml">http://news.softpedia.com/news/fbi-and-microsoft-warn-of-samas-ransomware-501914.shtml</a><br><span itemprop="author" itemscope="" itemtype="http://schema.org/Person"><a href="http://news.softpedia.com/editors/browse/catalin-cimpanu" title="Editor profile and more articles by Catalin Cimpanu" itemprop="url"><span itemprop="name"></span></a></span>
<div class="" id="newsbody">
<div itemprop="articleBody">
<p class=""><strong itemprop="description">A new ransomware family has inflicted enough damage for both Microsoft and the FBI to take notice of its actions, the last <a target="_blank" href="http://eweb.cabq.gov/CyberSecurity/Security%20Related%20Documents/FLASH%20MC-000068-MW.pdf">issuing</a> a public statement announcement on its site to warn US companies of the dangers surrounding this new threat.</strong></p>
<p class="">Detected under the names of <strong>Samas</strong>,
Kazi, or RDN/Ransom, this ransomware has been active only in the past
three months, and besides infecting some users in Europe, China, and
India, it made its impact felt in the US more than anywhere else.</p>
<q class="">Samas leverages JBOSS server software to spread to entire networks</q>
<p class="">According to the <a target="_blank" href="https://blogs.technet.microsoft.com/mmpc/2016/03/17/no-mas-samas-whats-in-this-ransomwares-modus-operandi/">Microsoft Malware Protection Center</a>,
a Samas infection starts when the attacker detects a vulnerable server.
The FBI says that in most cases this is a server running an outdated
JBOSS installation, but Microsoft said that the attacker also used
vulnerabilities in Java applications because of <a target="_blank" href="https://cwe.mitre.org/data/definitions/111.html">direct use of unsafe JNI</a> (Java Native Interface).</p>
<p class="">After cracking and penetrating a vulnerable server,
the crooks behind Samas are using an open-source tool called reGeorg to
scan and then map internal networks.</p>
<p class="">Attackers then deploy the Derusbi (Bladabindi) RAT
on the infected server. This trojan gathers login information for a
network's clients, and then using a third-party tool called psexec.exe
and a series of batch scripts, it will deploy the final payload, the
Samas ransomware, to the internal network's PCs.</p>
<q class="">Samas uses strong RSA-2048 encryption</q>
<p class="">Once on the victims' computers, Samas starts by
searching for a series of data files based on an internal list of
targeted extensions, and then encrypt their content with the RSA-2048
algorithm.</p>
<p class="">The "encrypted.RSA" extension is added at the end of
each infected file, and a ransom note is then left in every folder
where the ransomware found and locked files.</p>
<p class="">Samas asks 1 Bitcoin (~$400) per infected PC and
requires payment via a Tor-hosted website. Microsoft noted that during
its early stages, criminals used a WordPress.com blog to manage ransom
payments, but then decided to go for a service hosted on the Dark Web
instead, probably fearing an easy takedown from law enforcement.</p>
<div class=""><div class=""><em> Samas ransomware simplified mode of operation</em></div><a title="Click to view large image" href="http://i1-news.softpedia-static.com/images/news2/fbi-and-microsoft-warn-of-samas-ransomware-501914-2.png" target="_blank"><img src="http://i1-news.softpedia-static.com/images/fitted/620x/fbi-and-microsoft-warn-of-samas-ransomware-501914-2.jpg" title="Samas ransomware simplified mode of operation" alt="Samas ransomware simplified mode of operation"></a></div>
<p class="">Another Samas quirk is that the ransomware starts an
app called vssadmin.exe that deletes hard-drive shadow files and backup
files, in an attempt to make it harder for users to restore older
versions of their data.</p>
<q class="">Samas is a new breed of ransomware</q>
<p class="">Compared to other ransomware families that leverage
automated distribution schemes that involve spam or malvertising, Samas
takes an old-school approach that requires lots of scanning and manual
hacking.</p>
<p class="">A reason to go through such a complicated process is
that attackers are targeting private corporate networks, where they can
find more valuable data, which companies might be willing to pay to get
back.</p>
<p class="">This leads us to believe that Samas was developed
and is managed by people with advanced technical skills and lots of
experience in delivering and managing ransomware campaigns.</p>
<div class=""><div class=""><em> Samas ransomware ransom note</em></div><a title="Click to view large image" href="http://i1-news.softpedia-static.com/images/news2/fbi-and-microsoft-warn-of-samas-ransomware-501914-4.png" target="_blank"><img src="http://i1-news.softpedia-static.com/images/fitted/620x/fbi-and-microsoft-warn-of-samas-ransomware-501914-4.jpg" title="Samas ransomware ransom note" alt="Samas ransomware ransom note"></a></div>
</div>
<div class=""> <br></div></div></div>