AngleWare Ransomware

Posted: March 24, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	7

First Seen:	March 27, 2017
Last Seen:	April 18, 2018
OS(es) Affected:	Windows

The AngleWare Ransomware is a Trojan that uses encryption attacks capable of locking you out of your local files, such as documents. Although the AngleWare Ransomware borrows code from an open-source threat, Hidden Tear, that doesn't corrupt your operating system, it does use its file-locking features to hold your media up for ransom. Always use anti-malware products to isolate or delete the AngleWare Ransomware, and keep backups that can give you other options for recovering the contents of your PC.

The Trojan Mafia is Angling to Strike Back

Threat actors with access to the MafiaWare Ransomware variant of Hidden Tear's source code have made updates to the Trojan, and appear to be ready to deploy it for live attacks. This new version of the much-reused Hidden Tear program, the AngleWare Ransomware, contains only a few customized characteristics. However, its author is confident in the payload to demand ransom payments of three Bitcoins sufficiently, equaling nearly three thousand dollars.

The AngleWare Ransomware may target specific locations (such as the Users folder) when it begins encrypting content. Formats of data at high risk of being attacked include DOC, JPG, PNG, PPT, TXT and XLS. The AngleWare Ransomware uses the AES-based encryption to lock these files and adds the '.AngleWare' extension onto each of their filenames (without removing the original extension). Lastly, it creates a Notepad file on the logged-in Windows account's desktop with a ransoming message. The latter asks for a Bitcoin cryptocurrency payment to prevent the victim from canceling the transaction and provides the threat actor's e-mail for future discussions on unlocking your files.

The above features are typical of most versions of Hidden Tear as noted by malware experts on variants like the Xampp Locker Ransomware or the subject of this article's direct ancestor, the MafiaWare Ransomware.

Hiding a Hidden Tear Clone's Profits Away from It

Most versions of Hidden Tear-based threats, such as the AngleWare Ransomware, protect their encryption algorithms with a randomly-generated string that they use as a key. Although the threat actor demanding the ransom may give you the key, the lack of guarantees around such purchases causes malware experts to recommend against it in all but the most urgent of cases. Victims not capable of restoring from a backup should use free decryption resources that are compatible this family of Trojans, such as the Hidden Tear BruteForcer.

The expense of the AngleWare Ransomware's attempted extortion could mean that its threat actor is compromising business servers that store files equally valuable equally. In a majority of attacks of this nature, malware experts can trace the first security lapse to a user's contact with an e-mail spam message. This message may disguise itself to look like an internal employee message or a notification of a package delivery, for example. Regardless of any misleading file data, most anti-malware programs should be able to remove the AngleWare Ransomware while they scan its executable file.

Even though the AngleWare Ransomware uses code that any novice could implement with few changes, the AngleWare Ransomware estimates the damages of its payload in thousands of dollars. Whether or not its threat actor is overvaluing their campaign is something that only time will tell.

AngleWare Ransomware

Threat Metric

The Trojan Mafia is Angling to Strike Back

Hiding a Hidden Tear Clone's Profits Away from It

Leave a Reply