CryptoNar Ransomware

The CryptoNar Ransomware is a variant of the CryptoJoker Ransomware, a file-locker Trojan that extorts money from you after blocking documents and other media. Infections may contact a remote server for notifying the threat actor of the attack, delete your Windows restore points, disable some security features and create pop-ups. Since there is no decryptor available for variants of the CryptoJoker Ransomware, victims should recover their files from backups after letting an anti-malware program of their choice uninstall the CryptoNar Ransomware.

The Joke's on those Paying this Trojan's Ransom

The free CryptoJoker Ransomware is one of the smallest families of file-locking Trojans, unlike its much more prominent counterpart of Hidden Tear, but is a not-insignificant threat to those without file backups. Thanks to using a secure encryption feature with XOR and RSA algorithms, it can block a victim's files permanently, with the only chance of a decryptor coming through its ransom demands. However, a new variant of the Trojan, the CryptoNar Ransomware, is taking away even that risky chance of data recovery.

The CryptoNar Ransomware uses one of two extensions for flagging the media, such as pictures, documents or spreadsheets, that it blocks: '.partially.cryptoNar' and '.fully.cryptoNar.' It also can wipe any of the Shadow Volume Copy-based backups of these files and, additionally, disable some of the Windows's startup recovery features. It concludes its attack, after locking the user's recreational and work files, by delivering an interactive pop-up GUI with its ransoming instructions.

The CryptoNar Ransomware variant of the CryptoJoker Ransomware also includes a relatively more professional set of extortion instructions than its ancestor and asks for one hundred dollars in Bitcoins for the decryption code. However, malware analysts note that some samples of the CryptoNar Ransomware include issues with the templates for their key's transmission to the C&C server that could make recovering it (and, therefore, the victim's files) an impossibility.

Keeping Your Data from Becoming a Jest in Poor Taste

Users should have few issues with identifying the CryptoNar Ransomware infections afterward, which display the Trojan's name in the pop-up, as well as in the new extensions. Since there, still, is no freeware decryption tool for the CryptoJoker Ransomware or its variants, including both the CryptoNar Ransomware and the ExecutionerPlus Ransomware, malware experts emphasize the need for keeping secure backups as the only definite way of preserving any digital media from these attacks. On the other hand, the CryptoNar Ransomware doesn't include the ExecutionerPlus Ransomware fork's secondary feature of a cryptocurrency miner.

The CryptoNar Ransomware requires the Windows OS, as well as .NET Framework 2.0, and, otherwise, has few dependencies for running. Strategies for infection may use corrupted e-mail attachments, brute-force a network's non-secure login credentials, or circulate the threat with the help of torrents. Users should be attentive towards updating their security software for increasing the detection rates against this threat and deleting the CryptoNar Ransomware as soon as possible.

The CryptoNar Ransomware is the latest byproduct of helpful programmers giving the public, possibly, more insight into harmful encryption than they should have. A little knowledge can be a threatening thing, and most 'educational' file-locking Trojans, often, turn into the real thing surprisingly frequently and regularly.