maximum malware programs for windows are written in compiled programming languages like C or C++ and take the form of portable executable files which include .exe or .dll. Others use command-line scripting along with windows batch or PowerShell.
it’s rare to see purchaser–side malware written in net–based languages which include JavaScript, which can be in the main intended to be interpreted with the aid of browsers. but the home windows Script Host, a carrier constructed into windows, can natively execute .js and different scripting files out of the container.
Attackers have taken to this method in recent months, with Microsoft warning about a spike in malicious e mail attachments containing JavaScript documents again in April. ultimate month, security researchers from ESET warned of a wave of junk mail that distributes the Locky ransomware thru .js attachments.
In both of these cases the JavaScript documents have been used as malware downloaders — scripts designed to download and set up a conventional malware application. inside the case of RAA, however, the whole ransomware is written in JavaScript.
according to professionals from tech assist forum BleepingComputer.com, RAA relies on CryptoJS, a valid JavaScript library, to put in force its encryption recurring. The implementation seems to be strong, the usage of the AES-256 encryption set of rules.
as soon as it encrypts a record, RAA provides a .locked extension to its unique call. The ransomware targets the following file kinds: .document, .xls, .rtf, .pdf, .dbf, .jpg, .dwg, .cdr, .psd, .cd, .mdb, .png, .liquid crystal display, .zip, .rar and .csv.
“At this factor there may be no manner to decrypt the documents totally free,” said Lawrence Abrams, the founder of BleepingComputer.com, in a blog submit.
The RAA infections pronounced thus far by means of customers display the ransom word in Russian, but even though the risk best targets Russian-speaking users for now, it’s best a depend of time until it’s allotted more widely and localized for other languages.
it is very unusual for humans to send valid applications written in JavaScript via e-mail, so customers should avoid commencing this kind of file, even supposing it is enclosed in a .zip archive. There are few reasons for .js documents to exist outdoor websites and internet browsers within the first vicinity.
