D2+D Ransomware

Posted: May 22, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	12

First Seen:	May 22, 2017
Last Seen:	August 17, 2022
OS(es) Affected:	Windows

The D2+D Ransomware is a Trojan that claims to encrypt and block your files, which it does for the sake of demanding ransom money. Victims should try free unlocking methods recommended in this article before making any payments, which may be unnecessary. Update your anti-malware products to help them detect and remove the D2+D Ransomware, preferably, before letting its installation finish.

Promised Attacks not Yet Fulfilled

Threat actors aren't always dutiful about keeping their source code from leaking into the wider security community, and identifying a developing threat ahead of time can help formulate tactics for dealing with it. One of the 'in progress' Trojans recently caught is the D2+D Ransomware, which malware experts are confirming has no live encryption features. In spite of this missing functionality, the D2+D Ransomware shows one of the signature symptoms of a file-encrypting Trojan: a well-developed ransom-collection page.

The builds of the D2+D Ransomware under analysis, so far, show none of the usual features of file-encoding threats, such as searching the PC's directories for documents and other media to encrypt, changing filenames, or hijacking the desktop. However, the D2+D Ransomware does generate pop-up windows in a format usually associated with enciphering-based Trojans. The Trojan loads the window from a remote domain, displaying a general encryption alert, demands for Bitcoin ransom money within three days, and a field for inputting the decryption key.

However, not all of the elements in this Web page are traditional to campaigns of this type. The D2+D Ransomware provides a non-configurable, invalid Bitcoin wallet address, in addition to the atypical detail of characterizing its ransoms as being 'donations.' The threat actors also are offering supposed discounts, possibly to trick any victims into believing that acting in haste will help them save money for getting their files restored.

The Added Price of a Simple Cup of Coffee

The D2+D Ransomware's author feigns sociability by offering a 'cup of coffee' as an alternative to his hundred dollar Bitcoin ransom, but either payment option should be unneeded by any victims. This Trojan shows no real encryption routine and can't lock or damage your files currently. PC users needing to remove its pop-up can enter the preset password, which, for current builds, is '215249148.' Alternate methods of system recovery include using Safe Mode or a peripheral drive-based system bootup to load Windows without the Trojan.

In case the D2+D Ransomware's authors do make updates and add an encryption feature to this threat, backing up your content to other devices or servers can prevent harmful encryption from causing damage that's not fixable. Many versions of the AES-based encoding also are fully reversible with free software. Because industry-wide detection rates for the D2+D Ransomware are non-ideal, you also should update your anti-malware software regularly to help maximize the chance of detecting and deleting the D2+D Ransomware on sight.

As easy as it is to make a basic, non-consensual, encryption program, some threat actors don't even see the point of doing that much. Trojans like the D2+D Ransomware can seduce victims into paying out of pocket for nothing, as long as they believe everything they read in a pop-up window.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

dir\The Game v.10.exe

File name: The Game v.10.exe
Size: 2.22 MB (2221568 bytes)
MD5: 7b7ae9a55d2fb8d79503f5f6a4e622a6
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: dir
Group: Malware file
Last Updated: August 17, 2022