FireCrypt Ransomware

Posted: January 5, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	57

First Seen:	January 5, 2017
OS(es) Affected:	Windows

The FireCrypt Ransomware is a Trojan that encrypts your files to force you into paying a 500 USD ransom through Bitcoins in addition to other attacks that may harm your PC's performance or local resources. Since this Trojan damages your local content potentially irreparably, PC users at risk should protect their systems with anti-malware products capable of shutting down its infection vectors. Most anti-malware programs also should remove the FireCrypt Ransomware without incident, although free decryption is unavailable currently.

Turning Up the Burner on Your Hard Drive

New evidence is strongly implying that the same threat actors responsible for the late 2016's Deadly Ransomware are continuing their activities into the next year, albeit with the new branding of the FireCrypt Ransomware. Contact points and wallet addresses are striking commonalities between both of these threats, along with ransom message-based components. However, malware experts are hesitant to confirm that the FireCrypt Ransomware is a direct descendant or update to the old file-encrypting Trojan.

The FireCrypt Ransomware is originating from a CMD-based builder utility named 'BleedGreen.' Although this builder is less amenable to customization than most, professional threats of the category, such as CrySiS, the FireCrypt Ransomware does harbor some concerning features. Of these functions, malware experts can verify:

The FireCrypt Ransomware includes an optional auto-startup feature that lets the Trojan launch with Windows. Otherwise, the victim will have to launch the FireCrypt Ransomware manually, such as out of incorrect assumptions about the executable file's identity.
Misplaced encryption is the keystone of the FireCrypt Ransomware's payload and targets a hard-coded list of file formats. The encrypted files will not open until being decrypted, which is a service that the threat actors sell to their victims through a related pop-up window.
The Trojan also may monitor your memory processes for the Windows Task Manager and terminate that application by default. This can stop you from determining which programs are open or what resources are in use on your PC (possibly useful for its other functions, see below).
Another feature lets the FireCrypt Ransomware establish a concealed network connection and download files from a hard-coded Web address for the PTA.org website. It generates these files with semi-random names for the purpose of flooding your Temp directory and, eventually, eating all free HD space.

The Trojan's author also refers to that last attack as doubling as a Denial-of-Service feature. However, in practice, the function would have to launch from thousands of infected PCs simultaneously before impacting the PTA site significantly, making this Trojan a poor choice for any serious DDoS campaign.

A Simple Extinguisher for the FireCrypt Ransomware

The FireCrypt Ransomware is a very bare bones threat that doesn't provide most of the features that for-rent file-encrypting kits are expected to have. Despite its many shortcomings, the Trojan can block your files without any hope of recovery other than paying a con artist and praying that they'll keep their half of the transaction. The Trojan also represents a potentially persistent threat to your PC from excessive disk and network usage along with blocking an important Windows maintenance program.

No live infection vectors are verifiable for the FireCrypt Ransomware campaigns to date, and different threat actors may use the BleedGreen builder for circulating the FireCrypt Ransomware in various ways. Malware analysts suggest that readers keep their eyes on previously-verified avenues of infection, such as spam e-mail, and update their non-local backups every day.

Professional anti-malware programs should experience negligible issues in detecting and deleting the FireCrypt Ransomware. Before its installation, rather than afterward, also is your best chance of keeping your money and your files in the right places.

'suppfirecrypt@qq.com' Ransomware

FireCrypt Ransomware

Threat Metric

Turning Up the Burner on Your Hard Drive

A Simple Extinguisher for the FireCrypt Ransomware

Related Posts

Leave a Reply