Re: Kms Activator Virus
Anna Pybus
Mature virions of herpes simplex virus type 1 contain an activating factor that primes transcription from the five virally encoded immediate early (IE) genes. This activator is specified by a 65-kD polypeptide termed VP16. The action of VP16 is mediated through cis-regulatory elements located in regions adjacent to each IE gene. Although VP16 is normally introduced into cells by infecting virions, its trans-activating function can also be observed by cotransfecting cells with a plasmid that encodes VP16 along with a reporter gene driven by IE cis-regulatory sequences. We have used such an assay to examine the function of mutant forms of VP16. Our results provide tentative identification of two domains of VP16 that are crucial to its role in the induction of IE gene expression. One domain is located within the carboxy-terminal 78 amino acids of VP16 and is characterized by its acidity. Another domain, located in a more amino-terminal region of the protein, appears to tailor the specificity of VP16 for IE genes. According to the results presented in this and the accompanying paper, we predict that VP16 achieves IE gene specificity via protein: protein, rather than protein: DNA, interaction.
The potential of ribonucleic acid (RNA) as both informational and ligand binding molecule have opened a scenario in the development of biosensors. An aminated diamond-based RNA aptasensor is presented for human immunodeficiency virus (HIV) trans-activator of transcription (Tat) peptide protein detection that not only gives a labeled or label-free detection method but also provides a reusable platform for a simple, sensitive, and selective detection of proteins. The immobilized procedure was based on the binding interaction between positively charged amine terminated diamond and the RNA aptamer probe molecules with the negatively charged surface carboxylic compound linker molecule such as terephthalic acid.
Introduction
Windows Activator has been a popular tool for attackers to spread Trojan viruses. Recently, 360 Security Center found a new kind of ransomware, which was spread by disguising as a Windows Activator. Through our precise analysis, we found this ransomware has a hidden configuration function, which can view and modify the key and prompt information used for encryption, and also obtain key decryption through this interface.
Hidden debugging features
During the analysis, we found that the ransomware contains a hidden form that will be displayed after pressing F8. This configuration page allows users to configure the following information (obviously this is a debugging feature that comes with the virus):
Document Encryption
When making a ransomware virus, the creator is usually used to implement the encryption function by using the Crypto encryption library provided by Microsoft. However, the ransomware uses the open source library of CryptoPP. For file encryption, the virus only processes the first 0x500000 bytes (about 5M) of the file. The oversized files will no longer encrypt the latter part, and then the AES algorithm is called for encryption. These left an opportunity to decrypt the file.
Reminder
Disguising as normal software is a common means of spreading Trojan viruses, especially various types of cracking software and plug-in software. When users encounter this type of ransomware, they can protect themselves through the followings methods:
Recently, we identified RAX, the only known cellular activator of PKR, and reported that RAX phosphorylation on serine 18 is required for PKR activation, translation inhibition, and apoptosis following IL-3 deprivation.15,16 RAX and its independently discovered human ortholog PACT are ubiquitously expressed, 98% identical, and consist of 3 dsRNA-binding domains.15,17,18 The N-terminal first and second dsRNA-binding domains are necessary for association with dsRNA and PKR while the third, C-terminal domain is not required for dsRNA or PKR binding but is required for PKR kinase activation.19,20 Interestingly, expression of the nonphosphorylatable RAX(S18A) mutant promotes a dominant-negative phenotype when IL-3 is withdrawn from factor-dependent cells characterized by failure to activate PKR, delayed translation inhibition, and enhanced cell survival.16 However, it remains uncertain whether only specific cellular stresses such as growth factor deprivation, or rather various stresses, including cytotoxic drug or cytokine treatment and viral infection, coordinate apoptosis signaling through a RAX-dependent mechanism.
MEF cell lines were infected with vesicular stomatitis virus (Indiana serotype) at a multiplicity of infection (MOI) of 1 or 5 for 1 hour at 37C. Viability was measured 0, 8, and 24 hours after infection using trypan blue dye exclusion. After 24 hours of infection, culture medium was removed and saved while the infected cells were lysed, as described, to monitor viral protein levels by immunoblotting with antibody R1. Virus titer of the medium was determined on monolayers of BHK-21 cells at 37C.
PKR may be activated by dsRNA produced during viral infection including with VSV.35 To investigate whether the PKR activator RAX is also necessary for host antiviral defense or whether PKR functions independently following infection, MEFs with reduced RAX were tested for sensitivity to VSV. After 24 hours of infection with an MOI of 1 or 5, si164-expressing cells were only approximately 15% or approximately 10% viable, respectively, compared with control siRNA cells that remained approximately 78% viable (P = .03 and .01, respectively, n = 3; Figure 5A). Furthermore, exogenous expression of RAX, but not the nonphosphorylatable RAX(S18A) mutant, increased cell death following viral infection such that only approximately 41% compared with approximately 88% for vector-only control cells were viable (MOI 1, P = .002, n = 3; Figure 5A).
Most likely as a direct consequence of the inability to activate PKR, phosphorylate eIF2α, and block new protein synthesis during VSV infection, the viral N, P, and M proteins were produced more rapidly and to a higher level in si164-expressing cells compared with that in control cells (4 hours vs 24 hours; Figure 5D). Significantly, VSV titer from si164-expressing cells was over 1000-fold higher than that from control siRNA-expressing cells (1 108 vs 6 104, P < .001, n = 3; Figure 5E). In contrast, cells expressing exogenous RAX displayed both a decrease in viral protein production and an approximately 100-fold reduced virus titer (P = .05, n = 3) compared with vector control cells (Figure 5D-E).
The human T-lymphotropic retrovirus HTLV-III/LAV encodes a trans-activator that increases viral gene expression. We expressed this trans-activator in animal cells and studied its structural and functional characteristics. The putative trans-activator protein was immunoprecipitated from overproducing stable cell lines and shown to migrate as a 14-kilodalton polypeptide on sodium dodecyl sulfate--polyacrylamide gels. S1 nuclease mapping experiments showed that the trans-activator increases the levels of steady-state messenger RNA transcribed from the viral long terminal repeat promoter. Sequences within the R region of the HTLV-III/LAV long terminal repeat are essential for trans-activation. Quantitations of messenger RNA and protein showed that the protein increase was greater than the messenger RNA increase in CV1 and HeLa cells, indicating that more than one mechanism was responsible for the trans-activation and that cell type--specific factors may determine the final level of trans-activation.
The pathogenic human retrovirus, human immunodeficiency virus type 1 (HIV-1), is the major etiologic agent of the acquired immunodeficiency syndrome (AIDS) (Fauci, 1988). HIV-1, along with the related primate immunodeficiency viruses, HIV-2 and simian immunodeficiency virus (SIV), is a member of a subfamily of retroviruses known as lentiviruses. Other members of this subfamily include visna virus, caprine arthritis encephalitis virus (CAEV), equine infectious anemia virus (EIAV) and feline immunodeficiency virus (FIV). Lentivirus infection of the susceptible host typically results in a prolonged and chronic disease state affecting the immune and nervous systems as well as cells in a variety of other tissues (reviewed by Haase, 1986). Interestingly, these viruses display complex patterns of gene expression that are very different from those of the extensively studied Type C family of retroviruses. Specifically, proviral activation from a frequently extended period of latency is followed by a pattern of viral gene expression that is markedly temporal. During this time a number of differentially spliced viral transcripts may be observed.
In contrast to most DNA viruses, poxviruses replicate their genomes in the cytoplasm without host involvement. We find that vaccinia virus induces cytoplasmic activation of ATR early during infection, before genome uncoating, which is unexpected because ATR plays a fundamental nuclear role in maintaining host genome integrity. ATR, RPA, INTS7, and Chk1 are recruited to cytoplasmic DNA viral factories, suggesting canonical ATR pathway activation. Consistent with this, pharmacological and RNAi-mediated inhibition of canonical ATR signaling suppresses genome replication. RPA and the sliding clamp PCNA interact with the viral polymerase E9 and are required for DNA replication. Moreover, the ATR activator TOPBP1 promotes genome replication and associates with the viral replisome component H5. Our study suggests that, in contrast to long-held beliefs, vaccinia recruits conserved components of the eukaryote DNA replication and repair machinery to amplify its genome in the host cytoplasm.
Hildt, E., Munz, B., Saher, G., Reifenberg, K., & Hofschneider, P. H. (2002). The PreS2 activator MHBst of hepatitis B virus activates c- raf-1/Erk2 signaling in transgenic mice. EMBO Journal, 21(4), 525-535.
aa06259810