ACCDFISA v2.0 Ransomware
Posted: October 26, 2017
Threat Metric
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
Ranking: | 5,108 |
---|---|
Threat Level: | 8/10 |
Infected PCs: | 12,118 |
First Seen: | October 27, 2017 |
---|---|
Last Seen: | October 17, 2023 |
OS(es) Affected: | Windows |
The ACCDFISA v2.0 Ransomware is a Trojan that pretends to lock your files by encoding them, although its real function only places them into archives. Trojans of the ACCDFISA v2.0 Ransomware's family also can lock the user's screen with pop-ups that ask for money in exchange for the 'decryptor.' Since its victims gain no advantages from paying, they should use any other, appropriate methods for restoring their media and have an anti-malware program removing the ACCDFISA v2.0 Ransomware from the computer.
The Return of the Fake Pornography Police
Variations on the theme of fake anti-child pornography software have been in threat databases for years, including the ancient (by the standards of Trojans) ACCDFISA Protection Program, but have yet to lose any of their apparent potency. One new family using this theme to cover its attacks is the ACCDFISA v2.0 Ransomware, a group of Trojans last seen targeting Brazilian businesses. The actual installation of the ACCDFISA v2.0 Ransomware seems more highly focused than those of most, competing Trojans, and its victims may not commit blatant mistakes like opening corrupted e-mail attachments necessarily.
Threat actors seem to circulate the ACCDFISA v2.0 Ransomware to individual server systems by gaining access to passwords, and related login data, by still uncertain exploits. Standardized RDP features allow them to drop the ACCDFISA v2.0 Ransomware onto each compromised PC without needing any intermediary threats, such as a Trojan dropper. The ACCDFISA v2.0 Ransomware, then, can proceed with blocking the user's media, not by encrypting it, but by placing every file into a compressed and password-barricaded RAR archive.
After finishing this attack, the ACCDFISA v2.0 Ransomware displays a pop-up that claims to be an alert from a police agency. The included text accuses the compromised PC of being part of a child pornography spamming network and provides a premium, ransom-based feature for unblocking your files supposedly. However, further analysis from malware experts reveals that the ACCDFISA v2.0 Ransomware doesn't include a real decryption feature and, if paid, merely deletes the victim's media.
Having the Security to Beat Version Two of Old Trojans
While rewarding a Trojan to cure the same attacks it causes is a transaction with significant risks to it, the ACCDFISA v2.0 Ransomware offers even less incentive than most file-locking Trojans to pay a ransom. The ACCDFISA v2.0 Ransomware doesn't use the standard, individual encryption methods that are typical of families like Hidden Tear or the Globe Ransomware, and paying is detrimental to the victim's media naturally. Besides the ever-relevant value of having backups, malware experts suggest contacting appropriate anti-malware researchers to determine whether or not the ACCDFISA v2.0 Ransomware's archive password is retrievable.
The ACCDFISA v2.0 Ransomware's authors are compromising targets that are most likely of storing financially-valuable digital media, such as the servers of private businesses. Employees using network-connected systems should remain aware of the formats of phishing attacks that might collect passwords or login names, and use login combinations with complex and unique strings. Although malware analysts do encourage deleting the ACCDFISA v2.0 Ransomware only with the help of a dedicated anti-malware program, anti-malware products can't retrieve the passwords that are blocking any archived files.
The ACCDFISA v2.0 Ransomware is a not-often-seen combination of highly-motivated, personally interventionist installation exploits, semi-unusual data attacks, and fake legal warnings. This Trojan may not adhere to the traditions fostered by threats like Hidden Tear but is even more of a danger to systems that are missing any fail-safe backups.
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.