JNEC.a is a ransomware that runs on Microsoft Windows. It spreads through an exploit for the recently reported code execution ACE vulnerability in WinRAR. The interesting part is that the malware author chose an unusual method to deliver the file decryption keys. The ID number unique for each affected computer represents a Gmail address for the delivery of the key.
The WinRAR exploit enables the author to drop the malware into the Windows Startup folder, so it deploys on the next login. To hide its presence, the author named it “GoogleUpdate.exe,” so it is easily mistaken for Google’s update process.
JNEC.a is written in .NET and falling for it starts with extracting the contents of the rigged archive. A corrupt image of a girl is inside which, when decompressed, triggers and error and shows an incomplete picture.
The error and the picture fragment make everything seem like a technical fault, so the user won’t give it another thought. However, the ransomware is already added to the system.
After encrypting a computer, it will generate a Gmail address that victims need to create in order to receive the file decryption key once they pay the ransom.
Once executed, the ransomware encrypts data on the computer and appends the .Jnec extension to the file’s original one. The price for the decryption key is 0.05 bitcoins (about $200). The message states:
Deposit amount: 0.05 BTC
BTC Address: 1JK1gnn4KEQRf8n7pHZiNvmV8WTXfq7kVa
Your ID: [redacted]
Your Email: [redacted] (Create a mail to get the decryption key)
Although the address is available in the ransom note, it is not registered yet. This task falls in the hands of the victim if they want to recover their files after paying the ransom.
Just to make sure that the victims understand how they can recover their data, the malware author also provides clear instructions about creating specific Gmail address; these are available in a JNEC.README.TXT ransom note that the ransomware drops on an infected computer.