Raiders of the Javascript-based Malware
summary
A pure JavaScript ransomware executes under Windows Script Host, fetches a per-victim key from startwavenow.com before that CNC is taken down, uses the embedded CryptoJS/AES library to encrypt user docs, deletes VSS snapshots, and writes a Russian WordPad diversion while dropping and running st.exe (Pony Trojan) reconstructed from an AES‑encoded string. Web cryptojacking uses Coinhive/CryptoLoot scripts hidden behind eval obfuscation, an automated scan finds about 212 sites and individual pages drive CPU to ~97.5%.
AI-written summary · about
chapters (13)
- 0:00Start
- 2:30ELEMENTS OF A RANSOMWARE
- 4:34ABOUT RAA RANSOMWARE
- 7:07PROCESS GRAPH
- 7:43DIVERSION
- 8:22NETWORK ACTIVITY
- 9:02RAA CODE ANALYSIS
- 17:46SYSTEM IMPACT
- 19:02EXAMPLE OF JS-BASED MINING
- 19:32DEOBFUSCATION
- 20:20CRAWL RESULTS
- 21:35QUESTIONS DURING ANALYSIS
- 23:05CONCLUSION
related talks
52mRansomware 101: Get Smart Understanding Real Attacks
40mRansomware: Creation, Detection, and Response
41m"Revenge of The Script Kiddies: Current Day Uses..."
40mRansomware: New Recipe For An Old Dish
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
14mThe Conjuring: ransomware edition!!
19mThe Innerworkings of Ransomware
15mTales from the Underground: Hilarious Cybercrime Fails!!