Ahegao Ransomware

The Ahegao Ransomware is a file-locking Trojan that commits attacks for holding media like documents and pictures hostage. The Ahegao Ransomware also displays pop-ups similar to those of the '.wcry File Extension' Ransomware campaign. Users should depend on safe backups for recovering anything that the Trojan locks, but an up-to-date anti-malware product may remove the Ahegao Ransomware during infection attempts.

A Wannabe's Cry for Resurrection of a Sort

The '.wcry File Extension' Ransomware, the WannaCryptor Ransomware, and the WannaCry Ransowmare are names that all lead back to a series of notorious attacks that harvested Bitcoins from victims after exploiting an EternalBlue vulnerability in Windows environments. Although that family's heyday is long since gone, many threat actors favor its aesthetics for attacks of their devising. The Ahegao Ransomware is another copycat for books, although its attacks are tangible enough to be problems.

The Ahegao Ransomware, whose name is a slang reference to Japanese pornography, has no distinct, code-based connections to the old file-locker Trojans. It could be independent completely – or another variant of Hidden Tear, the 'freeware' proof-of-concept project. The Ahegao Ransomware conducts attacks that are standard for a threat of its kind: searching for digital media like documents, pictures, or music, and encrypting them using a time-efficient method like AES and RSA. The encrypted content can't open in previously-associated programs without a compatible decryption routine, first, and the Ahegao Ransomware marks them with its 'ahegao' extension.

The pop-up window that the Ahegao Ransomware creates is an interactive Web page or HTA file. It has English, copy-pasted instructions for a Bitcoin ransom, links to a wallet and e-mail for negotiations, and an image of a Japanese cartoon schoolgirl – solidifying its theme. Although it also claims a deadline for paying, malware experts can't confirm the presence of a 'kill trigger' that would delete files or destroy the decryption key after a given time.

Having Your Files Scrubbed Clean of Erotica Gags

Although the Ahegao Ransomware's encryption hasn't had a complete analysis for probing any security weaknesses, most file-locker Trojans use a fast but safe means of encrypting content. Unlocking documents or any media, therefore, depends mainly on victims already having backups on other devices. Malware experts also can recommend using advanced recovery utilities for Shadow Copy-based recoveries, in some cases, if not a majority of them.

Samples of the Ahegao Ransomware are propagating with random names, so far, and have unknown infection exploits at work. Server administrators should avoid logins that are at risk to brute-force attacks, and all users should be careful about enabling macros, Flash, or JavaScript – all of which harbor easily-abusable vulnerabilities. Preventing file-locker Trojan infections remains far simpler than reversing the effects of them, even in the case of a 'hobbyist' threat like the Ahegao Ransomware.

Professional anti-malware products should catch and remove the Ahegao Ransomware in many instances and are preferable for safe and complete disinfection. The Trojan is targeting Windows environments, only, for now.

The Ahegao Ransomware represents the efficient recycling methodology of threat actors who want working Trojans with as little work as possible. While the fact might seem semi-harmless, the Ahegao Ransomware's bullying users with generic warnings and recommendations make misinformation that much more prolific in a world that's full to bursting with it as it is.