Home Malware Programs Ransomware Kindest Ransomware

Kindest Ransomware

Posted: April 19, 2017

Threat Metric

Threat Level: 10/10
Infected PCs: 8
First Seen: April 19, 2017
OS(es) Affected: Windows

The Kindest Ransomware is a Trojan that encrypts your files and also decrypts them automatically while using its pop-up messages for promoting an educational video about file-encrypting threats like itself. Because of its potential for causing accidental, long-term damage to your media, malware experts don't recommend installing this Trojan without having backups, virtual environments, or other security measures in place. Until data on its distribution strategies are available, use anti-malware products to block files that could install this Trojan or remove the Kindest Ransomware afterward.

A Program Including a Little Cruelty with Its Kindness

In the advent of data-enciphering attacks becoming a favorable means for threat authors to make profits, one of the more unfamiliar side effects of the threat industry's changes is the methods some individuals use to educate the public. While malware experts and other threat industry researchers do their part to announce and analyze threats as they appear, some programmers take it upon themselves to attack PCs and tell their victims what they did wrong in the process. In worst case scenarios, the associated Trojans, like the just-verifiable Kindest Ransomware, may cause more damage than intended to the file system.

The Kindest Ransomware is another branch of the often more threatening Hidden Tear family of file-encrypting threats. Its first features conduct attacks similarly to those of less benevolent file-encrypting Trojans by deploying a combination of the AES and SHA256 encryptions to lock various files on your computer. Unlike most Hidden Tear releases, the Kindest Ransomware doesn't include any extension changes (most likely due to not intending for the content to remain encoded for very long).

The Trojan launches a pop-up message, which contains extortion demands for money typically, after completing the encryption attack. However, the Kindest Ransomware's authors don't seem to have profit as their primary motivation; malware experts find no demands from this threat other than a request to watch a safe YouTube movie on ransomware. Simultaneously, the Kindest Ransomware also begins decrypting your media, although watching the video, or otherwise interacting with the link, should be unnecessary.

Getting Your Kindness from Places Where It will not Blow Back on You

Although the Kindest Ransomware's authors have good intentions clearly, their philosophy of causing minor attacks to prevent bigger ones could backfire on unprotected PC users. Flaws in file-encrypting functions can cause permanent damage to content like documents, spreadsheets, pictures or compressed archives. Until the Kindest Ransomware finishes its decryption, its pop-up also may act as a lock-screen that prevents you from accessing necessary programs and the desktop. Other threat actors also could hijack the Kindest Ransomware's development and make changes to its links, thereby encouraging victims to visit an unsafe website.

Hidden Tear Trojans often delete the SVC data that allows Windows to recover content from its default backups. Storing secondary backups in places like peripheral devices or a cloud service can reduce any potential for harm from all file-encrypting threats, both inside and outside of the Kindest Ransomware's family. Many anti-malware programs also have positive detection rates for Hidden Tear-based threats and should delete the Kindest Ransomware without any incidents.

It's always better to educate yourself on the terms of your choosing, instead of hoping a stranger will have your best interests at heart. The Kindest Ransomware infections may be preferable to attacks that ask for thousands of dollars in ransom money, but avoiding an infection at all is always an ideal that worth achieving.

Loading...