{"id":17984,"date":"2022-02-02T10:17:40","date_gmt":"2022-02-02T18:17:40","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11717\/"},"modified":"2022-02-02T10:17:40","modified_gmt":"2022-02-02T18:17:40","slug":"news-11717","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11717\/","title":{"rendered":"To Joke or Not to Joke: COVID-22 Brings Disaster to MBR"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

FortiGuard Labs<\/a>\u00a0Threat\u00a0Research Report<\/b><\/p>\n

Affected platforms<\/b>: Microsoft Windows
Impacted parties<\/b>: Windows Users
Impact<\/b>: Unable to boot the machine
Severity level<\/b>: Medium<\/span><\/p>\n

Even now, almost two years after the COVID-19 pandemic started, there is no sign that cybercriminals will stop taking advantage of the situation as an attack vector. This time, however, this attacker uses a COVID pandemic that has not yet happened as bait. FortiGuard Labs recently discovered a new malware posing as a mysterious COVID22 installer. While containing many of the features of "joke" malware, it is also destructive, causing infected machines to fail to boot. Because it has no features for encrypting data demanding a ransom to undo the damage it inflicts, it is instead a new destructive malware variant designed to render affected systems inoperable. This blog explains how this malware works.<\/p>\n

Covid-22 in Action
<\/h2>\n

The malware file is named Covid22. For those unfamiliar with the naming scheme, COVID-19 is a short form of\u00a0Co<\/b>ronav<\/b>irusd<\/b>isease, and\u00a019<\/b>\u00a0represents the year the outbreak was first identified. The file name Covid22 plays off the current Coronavirus disease but applies that same image of fear and destruction to computers, potentially creating a cyber-pandemic in 2022. While we don’t know how exactly the malware was distributed, the malware author has tried to weaponize fear as bait to lure victims into opening the file.<\/p>\n

While the\u00a0malware<\/a>\u00a0itself is not sophisticated, it does take several actions designed to put fear into the victim before inducing true panic. But before that, when first manually running the file, it asks whether the potential victim wants to install Covid-22 on their machine, as if it were an application.\u00a0<\/p>\n<\/p><\/div>\n