“Malwarebytes identified a ransomware Trojan, part of the Urausy family, which was being spread by a new Exploit Kit dubbed Neutrino. This ransomware sample evaded AV detection for almost a day and uses several levels of encryption to hide its payload,” Segura told V3. “This practice is becoming more and more common these days as it makes detection by looking at traffic packets more difficult.”
The Neutrino attack pretends to be a legitimate Skype file to gain access to a user’s machine. It’s called this because the ransomware renames itself to “skype.dat” and is placed in the folder, along with a configuration file called “skype.ini,” said Cannell.
“The skype.dat ransomware has nothing to do with the legitimate Skype program that millions of people use for VoIP communication.”
At the end of 2012 security firm Symantec issued a report suggesting ransomware scams are now earning criminals as much as $33,000 a day.
Link: http://www.v3.co.uk/v3-uk/news/2255480/malwarebytes-uncovers-av-dodging-neutrino-exploit-kit-targeting-java