AdamLocker Ransomware

Posted: December 26, 2016

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	98

First Seen:	December 26, 2016
OS(es) Affected:	Windows

The 'AdamLocker' Ransomware is a Trojan that may lock your files by encrypting them, changing their extensions or modifying their permissions or attributes. While such attacks are meant to force you to pay a ransom for recovering your data, malware experts recommend implementing other options with the help of any appropriate recovery software or cyber security researchers. Keeping your PC protected with dedicated anti-malware products also can delete the 'AdamLocker' Ransomware and stop any data-harming attacks before they can occur.

Adam Strikes Back

The threat actor referring to himself as 'Adam' seems to be continuing launching Trojan campaigns in close succession to one another, possibly to confuse any recovery efforts by third parties. The 'AdamLocker' Ransomware is the newest file-locking Trojan joining the previous Free-Freedom Ransomware and the Roga Ransomware with an all-new ransom message. Unlike some of its relatives, early evidence leads malware experts to believe that the 'AdamLocker' Ransomware does include the ability to encrypt the files on the infected PC.

The 'AdamLocker' Ransomware may encrypt local content based on filtering out either inappropriate directories (such as the Windows folder) or inappropriate extensions. Of the latter, malware researchers most often find threats of this type targeting text data, such as Word documents or spreadsheets, as well as media like pictures or audio clips. In rare cases, the threat actor may configure threats like the 'AdamLocker' Ransomware to attack executable files, rendering their related programs inoperable, until you reinstall them.

The 'AdamLocker' Ransomware also loads a new extortion message, although it uses a similar, HTA-based format that malware experts also see with the Roga Ransomware and the Free-Freedom Ransomware. This pop-up window provides a simple shortcut to a website for paying its ransom in Bitcoins or other, equally difficult-to-trace currencies. Supposedly, making a payment will give the victim the decryption code that its threat actor threatens to delete if the PC user closes the original ransom window.

Shooing Death's Head Away from Your Files

Although any victim of a file-encrypting Trojan's attacks should consider what recovery options are available without paying a con artist's ransom, malware experts see additional reasons to emphasize these possibilities with the 'AdamLocker' Ransomware. Other threats by the same author are notable for providing inaccurate information about the means by which they lock your files, and the 'AdamLocker' Ransomware also may be vulnerable to third-party decryption tools. Paying the ransom may or may not return any legitimate form of file-unlocking service.

However, PC owners with a backup can simply ignore any decryption issues and overwrite the damaged files with the unharmed copies. To stop the backup from also being compromised, malware experts suggest that you disinfect your PC and remove the 'AdamLocker' Ransomware with the anti-malware product of your preference beforehand. Never give an infected PC potential access to your only remaining backups such as network-accessible drives or removable storage devices.

The word is still underway on how 'Adam' is distributing the 'AdamLocker' Ransomware to new PCs. PC owners with a substantial investment in their saved files should continue considering the benefits of having backups and automatic anti-malware defenses to counteract the payloads of data hostage-taking Trojans like the 'AdamLocker' Ransomware.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 477.18 KB (477184 bytes)
MD5: d4452adfc41a7075f5e5796172775898
Detection count: 71
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: December 26, 2016

Korean AdamLocker Ransomware