CTB-Faker

CTB-Faker is a Trojan that imitates the attacks of a file encryption program while, in reality, it uses simpler techniques than encryption for holding your data hostage. Like a real file encryptor Trojan, CTB-Faker's attacks are meant to force you to pay money for retrieving the contents of your PC, although other data restoration options always are the recommendation of malware experts. Although you may wish to reserve some quarantined samples for researchers in the PC security industry, you always should let your anti-malware products remove CTB-Faker and take any steps needed afterward for regaining the relocated content.

A Real Problem Hiding Under Fake Pretenses

The rise of threatening file encryption as a for-profit industry has resulted in various imitators in its wake, such as threats like the CryptoFinancial Ransomware that claim to be making a sophisticated encryption-based attack when it is, in fact, doing nothing more than deleting your files. With the recent CTB-Faker campaign, using ransom messages scavenged from other Trojans like the Critoni Ransomware (AKA CTB-Locker), PC operators now may face a new kind of quasi-encryption tactic. Rather than encrypting each file individually, CTB-Faker merely compresses them all into a hidden, password-protected ZIP archive.

CTB-Faker's infection vectors don't use the usual strategies focusing on either spam e-mail or website-based exploit kits. Instead of either of those options, CTB-Faker's Trojan dropper conceals itself as a fake erotica video on the profile pages of compromised adult websites. This file is hosted on a cloud server and includes a disguised executable that, when run, installs CTB-Faker's main SFX file, which drops various components, including batch files, executables, and Visual Basic Script-based content.

Malware experts can confirm current versions of CTB-Faker only attacking content based in the Users folder of Windows. Assuming that the owner uses default save paths, CTB-Faker could target documents, gaming saved data, desktop-stored information, and any movie or music-related media, among other possibilities. Although CTB-Faker only targets twenty-one data formats, it moves all whitelisted data to a custom ZIP file, instead of encrypting them on an individual basis. This process is relatively time and resource intensive, and could give the victim a chance to identify the attack before CTB-Faker completes its task.

Despite that drastic shift in attack methodology, CTB-Faker's ransom note is identical to those of previous, more traditional file encrypting Trojans, like the Critoni Ransomware.

A Genuine Response to a Trojan that's Less Threatening Than It Wants to Be

CTB-Faker appears to be a project of threat authors with less experience than most of their counterparts. CTB-Faker uses a much simpler than standard payload, a barely disguised installation exploit, and components that it borrows from other Trojan campaigns. Despite all of its limitations, CTB-Faker still is a potential threat to any PC user who lacks the foresight to back their data up.

PC users who, as malware experts recommend, back their data up routinely should be able to restore their files after uninstalling CTB-Faker through safe methods. If there are no spare copies of the ZIP-compressed content available, you may wish to save a sample of the original Trojan dropper for CTB-Faker, which can provide technical information to security researchers assisting you with data retrieval. Otherwise, let your anti-malware products remove CTB-Faker and all other threats they detect.

CTB-Faker doesn't truly remove or delete your files, nor does it encrypt them one by one. Instead, CTB-Faker only hides them in a password-protected location. Although paying the CTB-Faker's ransom could lead to a possible recovery process, giving con artists money in return for help that's equally easily accomplished by third party security institutions is, ultimately, needlessly self-destructive to both your finances and the state of the software industry.