DummyCrypt Ransomware

Posted: November 3, 2016

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	79

First Seen:	November 3, 2016
OS(es) Affected:	Windows

The DummyCrypt Ransomware is a Trojan that locks the victims' monitor and encrypts the contents of their hard drives. Threat actors can use these attacks to demand ransom money for the decryption and unlock keys, which they may not give after they take the payment necessarily. Most PC users should ignore the extortion instructions and follow this article's recommendations on restarting their computers and removing the DummyCrypt Ransomware.

A System Cleaner that Bleaches Your Files to Death

It's rare for any threat campaign to have a phase that's more delicate than the installation of the threat onto a victim's PC. A threat actor's choice of exploits and social engineering strategies can determine whether Trojans like the DummyCrypt Ransomware become successful or fail within their black market niches. The DummyCrypt Ransomware offers a look at one of the most low-tech but still-viable exploits for installing threatening software: pretending to be another, legitimate program.

The DummyCrypt Ransomware installers have been disguising themselves as executables for the CCleaner software, a freeware Registry and junk file optimizer, since at least early November of 2016. After the PC user runs the file to 'clean' their PCs, the DummyCrypt Ransomware scans for data to encrypt, with frequent targets including documents, spreadsheets or pictures. It encrypts these files with an AES cipher, blocking any further use of them until they're decrypted and returned to their non-encoded formats.

Current DummyCrypt Ransomware payloads also implement their ransom messages for the decryption solution in the form of an attack with a secondary function: locking the user's screen. This no-border pop-up window prevents the user from minimizing, resizing or terminating it, and maintains its foreground persistence for preventing any access to the desktop or the Windows UI.

Turning a Testing Trojan into a Common Dummy

Malware experts often rate local backups as being undependable recovery options against threats like the DummyCrypt Ransomware. However, backups not erasable by this Trojan before you disinfect your PC, such as cloud-based ones, can offer victims a way of recovering their data while avoiding the ransom payment. However, the disinfection also requires avoiding the same screen-locking function that the DummyCrypt Ransomware implements as part of its baseline attack.

You can block threats that lock your screen or interfere with their removal actively by restarting your PC through Safe Mode, which is available on all Windows PCs and a majority of other operating systems. Follow your OS developer's recommendations on accessing this option while rebooting your computer. If any associated threats persist in a Safe Mode environment, malware experts recommend falling back to an external startup option, such as a bootable USB device.

While removing the DummyCrypt Ransomware with their choice of anti-malware assistance, victims also might consider the many benefits of using safe download sources. Although 'cleaning' a computer of junk information can be a good idea, downloading a product like CCleaner from a less than safe source can be one of the fastest ways to infect your PC.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 105.98 KB (105984 bytes)
MD5: d6d335f18b318157ad00c4ffa9f32786
Detection count: 17
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: November 3, 2016