Home Malware Programs Ransomware ‘.trun File Extension’ Ransomware

‘.trun File Extension’ Ransomware

Posted: February 8, 2016

Threat Metric

Threat Level: 8/10
Infected PCs: 9
First Seen: February 8, 2016
Last Seen: January 5, 2023
OS(es) Affected: Windows

The '.trun File Extension' Ransomware is a file encrypting Trojan that blocks your ability to access files and encourages paying ransoms for their recovery. Such attacks are noticeable from changed file extensions and names, which provide visual identifiers of the encrypted files. Instead of paying a con artist to restore your data, malware experts stress the usefulness of free backups for accomplishing the same goal at no charge, as well as using anti-malware products for uninstalling the '.trun File Extension' Ransomware.

The E-Mail that Runs Away with Your Files

The '.trun File Extension' Ransomware is part of a threat campaign that has been active since early February, at a minimum, with recent samples of this threat including features for evading anti-malware analysis. Malware researchers found evidence of the '.trun File Extension' Ransomware's distribution model using e-mails, with the crafted messages disguising their attached payloads as being non-threatening documents. It currently is unknown whether these messages are targeting specific entities or random (or previously phished) addresses.

The '.trun File Extension' Ransomware includes an auto-launching routine that lets it start automatically, and, after launching, scan your files for particular types that it can encrypt. Unlike most file encryptors that use wide ranges of file formats for victimization, the '.trun File Extension' Ransomware only has been confirmed of attacking document and spreadsheet formats, such as Excel's XLS, Word's DOC and Adobe's PDF. The '.trun File Extension' Ransomware inserts the additional suffix '.trun' to each file, but, most importantly, encrypts these file, making them unreadable.

Once it's finished, the '.trun File Extension' Ransomware also places a text file on your hard drive. This message emphasizes the strength of the encryption method used and recommends e-mailing an 'expert' for assistance with a decryption solution, but doesn't mention the ransom fee, presumably to lure more victims into making contact.

Being an Expert on Beating File Encryptors

The '.trun File Extension' Ransomware may be less obvious than some Trojans in how it demands payment, but is no less benevolent than all other file-encrypting threats. As with most file encryptors, the '.trun File Extension' Ransomware attacks local data but has no impact on remote backups. Backup files stored on removable devices (that are unassociated with your PC at the time of infection) and cloud-based backups can restore your data without requiring any payment to an illicit entity. Local backups run the risk of being deleted by the '.trun File Extension' Ransomware or an associated threat.

PC users without experience in the anti-malware industry always should use their automated security software for removing the '.trun File Extension' Ransomware. Since file name changes provided by the '.trun File Extension' Ransomware are superficial, and have no impact on the encryption attacks, whether you choose to rename your files or not is up to you. On prevention strategies, reputable anti-malware tools also should be capable of identifying Trojan droppers and other threat installers distributing themselves through e-mail attachments heuristically. As usual, the installation of the '.trun File Extension' Ransomware, ultimately, can be laid at the victim's feet.

Loading...