Most of the malware and PC viruses come and go, but there are some malicious programs that remain strong and sometimes undetected for many years. The reason behind this strength is the fact that they continue to evolve and one such malware is the Kovter.
What is Kovter?
Kovter is a trojan virus that initially started out as a police ransomware but quickly evolved into a malware that is a click bait fraud (they trick people into downloading the malware on the PCs). The main purpose of this malware is to earn money for its designer, and it does this perfectly since it is a file less malware hidden so deep in the computer’s registry that it becomes hard to detect and delete it. The dangers involved with this malware are many like- Stealing personal information of the user, downloading more malware and making your device vulnerable to many notorious hackers.
Also Read : How Malware Attacks and Spreads in your Computer?
This pie-chart by CIS (Center for Internet Security) displays the effect of Kovter malware. It shows that Kovter is the cause for 55% of the total malware notifications.
How Did Kovter Evolve?
This trojan virus can’t spread by itself and needs the support of the user to run this by mistake on their laptops/PC or visit a site that is hacked or infected. Now you must be wondering about how and when this virus came into being, and here is the answer:
1. It was in 2013 that it was heard for the first time and at that moment it was pegged as a police ransomware, where it remained hidden in target computers and attacked only when someone illegally downloaded files. It triggered a warning message for the user then, and a fine which was equal to a ransom demand.
2. In late 2013 to 2014, it became more effective and started creating a nuisance as the second variant of Kovter was a click fraud malware. It used codes to infect the PCs and stole personal data, which are later sent to the Command and control servers.
3. In 2015, it became a file less malware, which was hard to find, and it infected various devices through an installation of autorun registry entries.
4. 2016 saw another evolution in it, and this was the addition of more files and registry entries.
5. The current form (2018) of this malware uses attachments coming from malicious spam for infecting the computers:
- These malicious attachments are usually corrupted Microsoft file, once users download these files; it creates a shortcut, batch file and a random file with any extension.
- Also, some registry entries are created. When the users restart the infected computer or open any of the shortcut/registry files, the malware starts attacking the computer.
- Once installed, Kovter continuously monitors every function done via the infected computer.
Symptoms That Indicates A Malware Presence:
Must Read : DeepLocker: Weaponizing AI In Malware Development
A file less malware is hard to find, but still, there are some hints like:
- The task manager may show that processes like mshta.exe or powershell.exe are running on the PC.
- An alert that states that PowerShell has stopped working
- Slow upload or start for any app
- Blocked or unreachable web pages
How To Stop Kovter From Infecting Your Pcs?
1. Security Updates: As soon as the updates are available, apply them as they keep this malware at bay. Also, update windows as old/outdated windows tend to attract much malware.
2. Block pop-ups: Pop Ups are the best and easy way through which malware/virus creators infects our website. So, stop clicking on suspicious software offer or advertisements pop-ups while surfing the net. You can even block them. You can use ad-blockers on browsers.
3. Anti-spam filters: Since the latest variant of Kovter comes through spam emails, organizations must have policies to avoid email-threats. Anti-spam filter is a great way to stop malicious emails to reach the mailboxes of users.
4. Have firewalls: Firewalls and solution can keep a lookout for this malware even though it is hard to detect.
5. Security Program: Always have a good and original version of an antivirus/anti-malware installed in your PC. Go for an antivirus that provides Malware removal tool.
It helps to be aware of such a malicious trojan that may harm your PC and steal your personal data. Also, the best thing is to keep backing up your important files/data so that even in case of getting infected, your data is safe. Practice these tips for a Kovter-free computer.
Leave a Reply