ACCDFISA v2.0 Ransomware

Posted: October 26, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	5,108
Threat Level:	8/10
Infected PCs:	12,118

First Seen:	October 27, 2017
Last Seen:	October 17, 2023
OS(es) Affected:	Windows

The ACCDFISA v2.0 Ransomware is a Trojan that pretends to lock your files by encoding them, although its real function only places them into archives. Trojans of the ACCDFISA v2.0 Ransomware's family also can lock the user's screen with pop-ups that ask for money in exchange for the 'decryptor.' Since its victims gain no advantages from paying, they should use any other, appropriate methods for restoring their media and have an anti-malware program removing the ACCDFISA v2.0 Ransomware from the computer.

The Return of the Fake Pornography Police

Variations on the theme of fake anti-child pornography software have been in threat databases for years, including the ancient (by the standards of Trojans) ACCDFISA Protection Program, but have yet to lose any of their apparent potency. One new family using this theme to cover its attacks is the ACCDFISA v2.0 Ransomware, a group of Trojans last seen targeting Brazilian businesses. The actual installation of the ACCDFISA v2.0 Ransomware seems more highly focused than those of most, competing Trojans, and its victims may not commit blatant mistakes like opening corrupted e-mail attachments necessarily.

Threat actors seem to circulate the ACCDFISA v2.0 Ransomware to individual server systems by gaining access to passwords, and related login data, by still uncertain exploits. Standardized RDP features allow them to drop the ACCDFISA v2.0 Ransomware onto each compromised PC without needing any intermediary threats, such as a Trojan dropper. The ACCDFISA v2.0 Ransomware, then, can proceed with blocking the user's media, not by encrypting it, but by placing every file into a compressed and password-barricaded RAR archive.

After finishing this attack, the ACCDFISA v2.0 Ransomware displays a pop-up that claims to be an alert from a police agency. The included text accuses the compromised PC of being part of a child pornography spamming network and provides a premium, ransom-based feature for unblocking your files supposedly. However, further analysis from malware experts reveals that the ACCDFISA v2.0 Ransomware doesn't include a real decryption feature and, if paid, merely deletes the victim's media.

Having the Security to Beat Version Two of Old Trojans

While rewarding a Trojan to cure the same attacks it causes is a transaction with significant risks to it, the ACCDFISA v2.0 Ransomware offers even less incentive than most file-locking Trojans to pay a ransom. The ACCDFISA v2.0 Ransomware doesn't use the standard, individual encryption methods that are typical of families like Hidden Tear or the Globe Ransomware, and paying is detrimental to the victim's media naturally. Besides the ever-relevant value of having backups, malware experts suggest contacting appropriate anti-malware researchers to determine whether or not the ACCDFISA v2.0 Ransomware's archive password is retrievable.

The ACCDFISA v2.0 Ransomware's authors are compromising targets that are most likely of storing financially-valuable digital media, such as the servers of private businesses. Employees using network-connected systems should remain aware of the formats of phishing attacks that might collect passwords or login names, and use login combinations with complex and unique strings. Although malware analysts do encourage deleting the ACCDFISA v2.0 Ransomware only with the help of a dedicated anti-malware program, anti-malware products can't retrieve the passwords that are blocking any archived files.

The ACCDFISA v2.0 Ransomware is a not-often-seen combination of highly-motivated, personally interventionist installation exploits, semi-unusual data attacks, and fake legal warnings. This Trojan may not adhere to the traditions fostered by threats like Hidden Tear but is even more of a danger to systems that are missing any fail-safe backups.

ACCDFISA v2.0 Ransomware

Threat Metric

The Return of the Fake Pornography Police

Having the Security to Beat Version Two of Old Trojans

Leave a Reply