BlackHeart Ransomware

The BlackHeart Ransomware, also identifiable as BlackRouter Ransomware, is a file-locking Trojan that targets your files with an encryption routine for stopping them from opening. Victims of its attacks also may experience pop-ups and the presence of text files asking for Bitcoins for the decryption of the affected media. While most anti-malware programs should delete the BlackHeart Ransomware automatically, all users should keep backups for recovering their damaged files.

The Beating Heart of Greed

A threat actor appears to be using the source code of the Spartacus Ransomware for creating his own, personal variant of that file-locker Trojan's campaign. The revised version of the software, the BlackHeart Ransomware, includes numerous internal references to the Star Wars media, such as an image component associated with an anti-AV check. However, the portion of its payload concerning the victim is, as usual, little more than a fast data-encrypting attack and a set of ransoming messages.

The BlackHeart Ransomware, which also refers to itself with the name of 'BlackRouter,' is a sub-three hundred kilobyte Windows executable. The most common name among various samples is 'SF.exe,' and malware analysts have yet to locate any active distribution points, such as spam e-mails or drive-by-downloads from exploit kits. The BlackHeart Ransomware includes a simple, data-encrypting routine that can lock documents, pictures, archives, slideshows, and other forms of media, particularly any content on the desktop or default Windows media locations like your Downloads folder.

The ransoming half of the BlackHeart Ransomware's payload creates an advanced Web page-based pop-up and a Notepad file as a fallback duplicate of the same content. The BlackHeart Ransomware gives the victims a custom code for their identification, a wallet link for paying two hundred Bitcoins, and the threat actor's e-mail address for, in theory, acquiring the decryptor. The fact that the BlackHeart Ransomware's author is using a Gmail-based address is suggestive of the campaign being unprofessional; malware experts more often see con artists utilizing free services through companies with less oversight than Google LLC.

Stopping the Lifeblood of Data Hostage-Taking Campaigns

Users can search for the extensions of 'pay2me' or 'BlackRouter' for clarifying which media the BlackHeart Ransomware is preventing from opening. Due to the BlackHeart Ransomware's using code that malware analysts rated as being potentially subject to a free decryption solution previously, anyone without other data-restoring solutions should consider contacting reputable members of the cyber-security community for their help with a decryptor's development. However, having backups, regularly-updated ones on another device, is the most consistently dependable means of recovering your files especially.

The fact that the BlackHeart Ransomware is rotating through various names for its 'brand' is implicative of the Trojan's campaign being in an unfinished state. Likewise, malware analysts have caught no identifiable distribution exploits for this threat within a live environment. Most anti-malware products should remove the BlackHeart Ransomware automatically, regardless of its arrivals methods, such as spam e-mails or website attacks, like the Nebula Exploit Kit.

By the standards of its competition, the BlackHeart Ransomware's ransom is 'affordable.' However, giving a con artist two hundred dollars in a non-refundable currency for the promise of getting your files back is a purchase without much hope of seeing a good-faith fulfillment.