Armage Ransomware

The Armage Ransomware is a file-locking Trojan that can encrypt different media file types for keeping them from opening, as well as removing Windows shortcuts. These attacks often include other symptoms for promoting a ransoming-based unlocking service from the Trojan's admin. Malware experts encourage using free data restoration choices when possible, and anti-malware products for removing the Armage Ransomware from the PC.

The Trojan that's Tidying Up Your Desktop

Threat actors who aren't focusing on stealth as an essential component of their Trojans' payloads, sometimes, include secondary features for keeping the user's UI accessibility to a minimum. These restrictions on system access and control can provide rash actions, such as paying ransoms in the Armage Ransomware campaign. However, in contrast to the file-erasing Jigsaw Ransomware, or a screen-locking threat like the WinBan Ransomware, the Armage Ransomware uses a tactic of its own to inconvenience its victims.

The Armage Ransomware core, identifying feature is a routine for encrypting the user's media content with an algorithm that malware experts can't yet identify, although a variant of AES is very likely. Any pictures, such as JPGs, text documents, and other, non-essential files suffer from both internal data enciphering and the insertion of '.armage' extensions in their names for locking them. Although the Armage Ransomware is, overall, not a work in progress or is displaying any significant glitches, neither do current samples offer any ransoming notes, as per most file-locking Trojans. A future build could deliver ransoming demands for unlocking your files via desktop wallpapers, pop-ups, local Web pages or Notepad text files.

The Armage Ransomware doesn't 'lock' the screen with its desktop, but it does accomplish a similar effect by deleting all of the user's shortcut icons. However, malware experts see no advanced, program-blocking features in the Armage Ransomware. Any users should be capable of opening their non-encrypted files by pressing the Windows key and the 'E' key and, then, inputting the relevant filename in the search field in the upper-right corner.

Wiping Out a Desktop Wiper

The Armage Ransomware, like almost every file-locking Trojan of any competence, erases the user's local backup and system restore data, which keeps them from using any built-in Windows solutions for recovering any media. Due to how common this security risk is, malware experts recommend always saving backups on other devices for recovering after you disinfect the primary PC. The Armage Ransomware is only compatible with Windows PCs, and no information on the threat actor's ransom price is available.

File-locking Trojans are numerous in e-mail spamming campaigns that use fake attachments with inaccurate filenames, incorrect icons or extensions, or embedded macros with their disguises particularly. Some threat actors also use manual means of compromising networks, such as brute-force tools, which are most threatening to users with poor login credentials. Appropriate password security and updated anti-malware software for deleting the Armage Ransomware are the other, most relevant means of protecting your files.

The Armage Ransomware is a more creative, file-locker Trojan than most of its competition, but also, isn't the only one to try to keep PC users from getting to the rest of Windows. Knowing a few shortcuts and accessibility tricks can go a long way to recovering your control over a computer and disinfecting it.