Ransom32, a new Filecoder in sight

A new ransomware has been discovered recently and among its distinguishing characteristics is the fact that it pretends to be Google’s Chrome browser. ESET’s security solutions detect this threat asWin32/Filecoder.NFR and it was first analyzed by Emsisoft, which named it Ransom32.

It works in the form of  ‘Ransomware as a Service’ (RaaS) from a hidden server in the Tor network. There, cybercriminals can choose what malware will infect the victim, how many bitcoins it will ask for as a ransom and what threatening messages it will show in the screen. They can also see statistics on how many users were infected and how many of them actually paid.

Ransom32, a new Filecoder in sight