This cruel ‘ransomware decryptor’ only makes things worse

Researchers have identified a fake ransomware decryptor circulating online that only serves to add to victims’ problems.

The phoney decryptor preys on users infected with the pervasive STOP Djvu ransomware which, unlike the most famous ransomware variants, primarily targets individuals as opposed to businesses.

According to researchers at MalwareHunterTeam, installing and running the fake STOP Djvu encryptor subjects the victim to a second ransomware attack.

The second ransomware, called Zorab, infects the user’s device and doubly encrypts their files, rubbing salt into the existing wound.

Fake ransomware decryptor

STOP Djvu is among the most prolific ransomware strains in circulation, infecting a greater number of victims than the infamous Maze, Sodinokibi, Netwalker and DoppelPaymer ransomware combined.

Concealed within rigged software cracks, it infects over 600 users per day, making it the most widely distributed ransomware over the last 12 months.

Decryptors for older iterations of STOP Djvu have previously been made available online for free, which could have led victims to place greater trust in the fraudulent decryptor than they otherwise might.

Once installed and activated, the sham decryptor extracts a second executable, crab.exe, which installs the Zorab ransomware, further encrypts data and deposits a ransom note in each folder containing an encrypted file.

The ransom note demands the victim purchases a decryption tool from the ransomware operator and warns them against using third party software to address the infection.

Zorab is currently undergoing analysis and users are advised to refrain from paying the ransom fee until the malware has been scoured for weaknesses.

Via Bleeping Computer

Source Article

Frederic M. Kolodziej

Next Post

Microsoft shows AI journalism at its worst with Little Mix debacle

Tue Jun 9 , 2020
With a global pandemic keeping us pretty occupied for the past few months, you may have allowed yourself to forget about that other apocalyptic danger – that is, unchecked artificial intelligence. Unfortunately, an AI program being put to use at Microsoft’s MSN.com has brought it back into the spotlight. The […]