Blackmail virus is a new type of computer virus, which is mainly spread in the form of mail, Trojan horse and web page. This virus has a bad nature and is extremely harmful. Once infected, it will bring immeasurable losses to users. This virus uses various encryption algorithms to encrypt files, and infected people generally can't decrypt them. Only when they get the decrypted private key can they crack them.

Transmission path:

Once the blackmail file enters the local area, it will automatically run, and at the same time delete the blackmail sample to avoid killing and analysis. Next, the ransomware connects to the hacker's C & ampc server with local Internet access, then uploads local information and downloads the encrypted private key and public key, and encrypts the file with the private key and public key. It is almost impossible to decrypt except the virus developer himself. After the encryption is completed, the wallpaper will be modified, and a blackmail prompt file will be generated in an obvious position such as the desktop to guide the user to pay the ransom. Moreover, the variety type is very fast and it is immune to conventional antivirus software. The attack samples are mainly exe, js, wsf, vbe and so on, which is a great challenge to the conventional security products that rely on feature detection.

According to the characteristics of ransomware, it can be judged that its variants can usually hide its characteristics, but cannot hide its key behaviors. Summarize the behavior of ransomware during operation, mainly including the following aspects:

1, through the Http request of the script file;

2. Download files through script files;

3. Read the remote server file;

4. Collect computer information;

5. Traverse the file;

6. Call the encryption algorithm library.

In order to prevent users from being infected with this kind of virus, we can start from two aspects: security technology and security management:

1. Don't open emails from strangers or unknown sources to prevent attacks through email attachments;

2. Try not to click on the office macro run prompt to avoid office components being infected with viruses;

3. Download the required software from the regular (official website) way. Don't double-click to open a suffix file such as. Js and. vbs

4. Upgrade persuaded NGAF to the latest anti-virus security feature library;

5. Upgrade the anti-virus software to the latest anti-virus database to prevent the attack of existing virus samples;

6. Back up important data and files in different places regularly to prevent viruses from being recovered.

I hope I can help you, thank you!