'All_Your_Documents.rar' Ransomware

Posted: February 14, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	13,535
Threat Level:	10/10
Infected PCs:	1,098

First Seen:	February 14, 2017
Last Seen:	September 16, 2023
OS(es) Affected:	Windows

The 'All_Your_Documents.rar' Ransomware is a Trojan that compresses your files into an RAR archive to lock them out of your possession. It uses other aspects of its payload to ask for cryptocurrency payments before its threat actor provides the password for the archive. This threat is in live deployment, and malware experts suggest that you use backups to another system and active anti-malware protection as strategies for hampering and removing the 'All_Your_Documents.rar' Ransomware.

What's Wrong with Having All Your Documents in One Place

Although threat authors have a wealth of options for implementing ransom schemes against digital data, a sophisticated hostage-taking technique isn't always a prerequisite for collecting money under duress. One of the simplest types of file-encrypting Trojan may opt for using a third-party utility, such as WinRAR, for locking the files on your PC comprehensively. Late in 2016, WinRarer Ransomware was one Trojan campaign that malware experts could confirm for employing this tactic. Months later, the 'All_Your_Documents.rar' Ransomware follows a similar pattern.

Similarly to more traditional types of file-encryptor Trojans, the 'All_Your_Documents.rar' Ransomware attacks such files as Word documents or Notepad text. Instead of enciphering each one at an individual level and modifying their names, the 'All_Your_Documents.rar' Ransomware moves them to a compressed archive that it generates via an additional WinRAR component. It also password-protects the archive to keep you from opening it and retrieving any of the affected data.

The Web page-based ransom infrastructure for the 'All_Your_Documents.rar' Ransomware's campaign is where malware analysts see the greatest similarities between the Trojan and other file-encrypting threats. The Trojan's threat actor recommends using a Tor Browser (for anonymity purposes) to access his website, where the victim can view the Bitcoin fee required for buying the RAR's password. Although the 'All_Your_Documents.rar' Ransomware's ransom starts at a 354 USD value, it also may increase incrementally, with time.

Doing Your Archival Work Before a Trojan Does It for You

Compressing files into a passworded archive is a far from a massive technical achievement, but does represent one of the easiest ways of keeping a PC's user from accessing their belongings. Although sample availability for the 'All_Your_Documents.rar' Ransomware is non-ideal, malware researchers do verify that the Trojan is being deployed live through undetermined infiltration methods. Con artists often, but not solely, prefer to deliver threats of this type via e-mail or RDP port hacking.

Because the 'All_Your_Documents.rar' Ransomware may delete local backup-related data, you always should save any preemptive backups to an external drive or server that the Trojan can't attack. Malware researchers have yet to determine whether or not the 'All_Your_Documents.rar' Ransomware's password protection is breakable, and backups may be the only way for the victims to retrieve their data without paying the ransom. Anti-malware products also may quarantine the 'All_Your_Documents.rar' Ransomware safely for later sampling purposes as an alternative to fully removing the 'All_Your_Documents.rar' Ransomware.

The mild abuse of freeware like WinRAR is an often-seen trait from people less interested in designing custom threat than in making as much money as possible with as little investment as they need. While some countermeasures are available for an already-comprised system, your defenses against easily mass-produced Trojans like the 'All_Your_Documents.rar' Ransomware always should err on the preventative side.

'All_Your_Documents.rar' Ransomware

Threat Metric

What's Wrong with Having All Your Documents in One Place

Doing Your Archival Work Before a Trojan Does It for You

Leave a Reply