Loading malware…
Urausy is a Windows screen-locking ransomware family that restricts access to the desktop and demands payment through MoneyPak or Ukash payment codes. Its demonstrated impact is computer lockout rather than file encryption. Distribution has included drive-by downloads through the Neutrino exploit kit exploiting Java vulnerabilities CVE-2012-1723 and CVE-2013-0431, malvertising redirects to the Sibhost exploit kit, and deployment to already-compromised systems through botnet tasking.
Analyzed variants use encrypted payload delivery, custom unpacking, encoded strings, and debugger detection to hinder detection and analysis. A documented execution chain injects a modified system DLL into Windows Explorer, redirects execution through API hooking, and subsequently injects code into a suspended Windows service-host process. The ransomware downloads and unpacks ransom-interface resources, displays a browser-based lock screen on a separate desktop, blocks desktop access, and terminates Task Manager processes. It surveys the host environment, including checking for antivirus processes, and maintains persistence by replacing the default Windows startup shell.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In CVE-2013-0431, the malicious Java Applet bypasses the security manager for Java version 7 update 11 by using a malicious serialized file, Jhelper.dat ... malicious applets can run without any warnings or user interaction.
This is a new Exploit Kit, dubbed neutrino, identified in the wild by Kafeine. ... It uses two Java vulnerabilities: CVE-2012-1723 CVE-2013-0431.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Earlier ransomware family mentioned for comparison with CryptoLocker.
Screen-locking ransomware delivered through a Neutrino exploit-kit drive-by download. The analyzed variant renames itself skype.dat, stores itself in the user's AppData folder, and persists by becoming the default startup shell. It unpacks obfuscated code, checks for a debugger, injects a modified ntdll.dll into Explorer, and subsequently executes within an injected svchost.exe process. It surveys running antivirus processes, downloads a local HTML ransom interface, restricts desktop access, and terminates Task Manager. Victims are asked to provide MoneyPak or Ukash codes. The content describes locking users out, not file encryption. The reported discovery date applies to this sample, not necessarily the family.
An earlier locker/ransomware family cited as the basis for Nymaim and visually/design-related to Bomba Locker/Lyposit.
Ransomware mentioned as being pushed via existing botnet infections and also delivered through exploit-kit-driven malvertising.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.