SerbRansom Ransomware

Posted: February 14, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	63

First Seen:	February 14, 2017
OS(es) Affected:	Windows

The SerbRansom Ransomware is a Trojan able to lock your files by encrypting them, which it uses for soliciting cash ransoms. The Trojan's instructions also warn the victim of additional data-erasing attacks, although malware analysts estimate that the Trojan's current build doesn't implement them. Cautious network security measures, regularly-updated backups and the use of anti-malware products for eliminating the SerbRansom Ransomware all are possible defenses against this threat.

A Trojan with Serbian Pride

Although the nature of ransomware may lend itself to a rent-based model, there are limited standards of quality in the threat black market. Con artists can pay hundreds of dollars for products that may not deliver all of the attack features that they make claims of providing or provide them with low-level coding techniques that are easily analyzed and cracked. For 2017, the new SerbRansom Ransomware family fits this description, and hopefully will be in highly limited distribution due to its lack of quality.

The SerbRansom Ransomware's Serbian author is selling the Trojan for third-party use with prices still under determination. Although the SerbRansom Ransomware is not particularly advanced compared to more sophisticated families like the Crysis Ransomware, it does have some of the attacks and defenses one would expect of a file-encrypting Trojan. Some of these core features include deleting System Restore backups, code obfuscation, a User Account Control-bypassing exploit, personalized filename extensions, and selecting different files to hold for ransom based on their formats.

The SerbRansom Ransomware's ransom message, which uses the Bitcoin cryptocurrency to protect the transaction from any cancellations afterward, is notable for incorporating Serbian background music from a YouTube-hosted video. Malware experts also can connect the identity of the SerbRansom Ransomware's creator to other threats, including backdoor-capable Trojans and utilities for compromising Croatia-hosted websites.

Turning a Simple Threat into Simply-Resolved Problems

The SerbRansom Ransomware isn't a threat deployed actively in any current or past campaigns, and its author seems still to be in the 'marketing' stage of the Trojan. However, just as the SerbRansom Ransomware, itself is a simple application, its builder utility is an easy-to-use program that can allow threat actors to create custom variants without needing to know much about programming. Malware experts also stress that R4z0rx0r, one of the individuals responsible for this product, also has expressed an interest in compromising systems via Remote Desktop Protocol-based attacks, relying on the presence of excessively weak passwords.

If samples of 'before and after' encrypted content and the Trojan, itself, are available, free decryption may be possible with the efforts of interested individuals in the cyber security industry. However, decrypting payloads like the SerbRansom Ransomware's sometimes is impractical, forcing malware researchers to encourage the regular update of backups that you don't store on the local machine. Since most threats of this category use e-mails for proliferating, scanning e-mail attachments with anti-malware utilities can help catch and remove the SerbRansom Ransomware without letting the encryption take place.

The SerbRansom Ransomware's authors may be making up for their lack of talent with industriousness; malware experts already see complementary threats from the same group, such as the Old Phantom Crypter. Whether you're Serbian or another nationality entirely, it behooves anyone with an investment in their files to back them up to prevent ransoming attempts by novice Trojans from succeeding.

SerbRansom Ransomware

Threat Metric

A Trojan with Serbian Pride

Turning a Simple Threat into Simply-Resolved Problems

Leave a Reply