Cyware Daily Threat Intelligence March 26, 2018

AvCrypt ransomware
A new ransomware, called AvCrypt, was discovered trying to uninstall the antivirus present on the computer before encrypting the user's files. This ransomware behaves like a wiper and removes numerous services while providing no contact information. It also checks which AV software is registered on the Windows Security Center and tries to remove it with another command.

Rapid 2.0 ransomware
Malicious authors have come up with a new, improved version of Rapid ransomware--called Rapid 2.0. The new version has a modified code routine that helps the hackers detect the users’ locale settings before launching an encryption operation. However, this ransomware has been found not encrypt data on PCs with Russian locale.

Sanny malware
FireEye, a cybersecurity company has found a new malware, dubbed Sanny, being distributed via malicious macro-based Microsoft Word documents. These malicious documents are being distributed in the form of relevant regional geopolitical issues, to governments across the world.