1337Locker Ransomware

The 1337Locker Ransomware is a variant of the My Little Ransomware, a group of Trojans that can block files by encrypting them and lock your screen with their ransom-demanding pop-ups. PC users who can't recover by reverting to a backup always should use all available, free decryption options before considering a file-locking Trojan's ransoms. Various anti-malware products also are beginning to add this threat to their databases and may remove the 1337Locker Ransomware automatically.

Too 'Leet' for Legal Programming Jobs

Although it can be easy to think of most Trojans as byproducts of publicized brands like the Jigsaw Ransomware or Hidden Tear, many threats are either independently-designed or arise from one of the more stagnant families. The sometimes overlooked My Little Ransomware is a grouping of some of the lesser known Trojans using encryption as an extortion tool. The M0on Ransomware and the LanRan Ransomware are two of the older members malware experts previously verified, now, joined by the much younger 1337Locker Ransomware.

The 1337Locker Ransomware's distribution model appears to be disguising the Trojan's executable to look like a fake PDF document, which is common for threats attached to spam emails or downloaded by the exploits inside of such attachments. Different variants of the My Little Ransomware family may display moderately different symptoms. However, malware analysts can confirm the below attacks:

• The 1337Locker Ransomware uses encryption, most probably but not definitively a version of the AES, to lock files on the PC. The content most often subjected to these attacks includes documents, spreadsheets, pictures, compressed archives, slideshows and music. Extraneous name changes also may accompany this attack (such as the 1337Locker Ransomware appending a '.1337' extension).
• The Trojan also displays a borderless window with its ransom demands: contacting a threat actor via the UI for further instructions. The con artists usually will ask for payment ahead of time to decrypt your files, using non-refundable currencies, and may not provide the service they promise. This attack also can block your access to the desktop, like other versions of the My Little Ransomware.

Taking a not Very Elite Con Artist Down a Peg

Using free decryption software always is safer than paying a threat actor who may not honor his word, or even be capable of providing complete file recovery. However, such software sometimes is unavailable, particularly for small families like the My Little Ransomware. Malware experts, in general, recommend that you back any content that you can't afford to lose up to another device. Default backups that Windows stores automatically, such as the Shadow Copies, shouldn't be assumed to be safe from being deleted by threats like the 1337Locker Ransomware.

The 1337Locker Ransomware usually will install itself through exploiting attacks that lure the victims into launching the file, themselves. Scan unusual downloads and attachments with appropriate security programs to detect Trojan downloaders, file-encrypting ones, and other threats that use inaccurate names. While removing the 1337Locker Ransomware will not unlock any content that the Trojan has encrypted, most anti-malware products should intervene before the Trojan's payload can complete itself.

Because of the limited attacks corroborated, so far, not much data is available concerning the 1337Locker Ransomware's ransoms. However, such fees can be as high as thousands of dollars; taking such an expensive gamble with your media never is one that will pay off.