Alert: understand now how the virus that infects Word files works

A strain of virus called AstraLocker recently released a new version, which infects email attachments email through quick attacks, but capable of causing great damage. Read on to find out how this works. ransomware.

Read more: Google AI 'Child' May Slip Away And Do Bad Things, Insider Claims

How does ransomware work?

Ransomware such as AstraLocker is essentially malware that encrypts relevant files on a device's local and network storage, demanding a ransom to decrypt them.

The most common ways of spreading malware are tricking users into opening malicious email attachments or opening files downloaded through links in emails.

On the other hand, it is also common for ransomware to be hosted on pirated software download pages. Furthermore, in other cases, users manage to infect computers when people open files from other untrustworthy sources or use fake installers.

AstraLocker – How does the virus that infects emails work?

The bait used by the operators of AstraLocker 2.0, in short, is a different Microsoft Word document, which hides an OLE object with the payload of the ransomware. Accordingly, the embedded executable uses the file name “WordDocumentDOC.exe”.

According to a code analysis by ReversingLabs, the AstraLocker virus is based on the leaked source code of Babuk, which, in turn, is a buggy but still dangerous strain of ransomware that came out in September 2021.

How does this virus usually infect the computer?

In general, emails designed to spread this malware are disguised as urgent/important letters from legitimate companies or other entities. In this way, the person receives it and is not aware of the fact that there may be malicious content there.

In that sense, these are some examples of files that cyber criminals use to distribute malware MS Office, files like ZIP and RAR, PDF documents, as well as JavaScript files and executables.

What can happen if your files get infected by this virus?

If your computer gets infected with AstraLocker, some things that may happen are as follows: you will not be able to open files stored on your computer; previously functional files can now have a different extension (eg my.docx.locked).

Furthermore, you may notice a ransom demand message on your desktop, because as stated earlier, cyber criminals often demand ransom payment (usually in cryptocurrencies like bitcoins) to unlock their files.