DXXD Ransomware

Posted: September 28, 2016

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	18

First Seen:	September 28, 2016
OS(es) Affected:	Windows

The DXXD Ransomware is a file-encoding Trojan that uses encryption to take your saved data hostage. These attacks most often are initial phases in ransom strategies that try to sell decryption options to the victims, although there are free decryptors for the DXXD Ransomware. Use whatever means you see fit to recover your encrypted content, but only after deleting the DXXD Ransomware with anti-malware tools to prevent any new attacks.

A Security Center Whose Advice is Worth Less than Nothing

Social engineering often is just as important to the success of a threat campaign as the code included in the threatening software. In the many file encryption-based attacks of 2016, malware analysts see different methods for tricking or bullying victims into giving con artists their money. Although most threats use messages that put the victim under time pressure, others, like the DXXD Ransomware, try to misrepresent their threat actors as being technical support employees.

The DXXD Ransomware uses standard encryption attacks to target data, such as documents. However, early estimates by malware experts lead to the conclusion that the DXXD Ransomware most likely isn't using asymmetric encryption methods, such as AES and RSA combinations, to protect its key. The encrypted content still is unusable until you decode it, and the DXXD Ransomware does add name changes to each file: the 'the DXXD' string, although, possibly due to a typo in its code, it appends this text without the dot that signifies a new extension.

Along with a text message asking for further e-mail communications (for negotiating its ransom fee), the DXXD Ransomware also modifies the Windows login screen. The modification attempts to tie the con artists' e-mail addresses with the Windows technical support via references to features like the Security Center and Windows Defender, encouraging you to pay what you believe to be a Windows employee, instead of a Trojan's administrator.

Decoding a Cheap Resolution to the DXXD Ransomware Infections

The DXXD Ransomware campaign is still under analysis by malware experts for significant infection vectors, with specially-crafted e-mail messages being the Trojan's probable vehicle. The latest indications show that this Trojan's administrators may target business servers, which lets them achieve potentially widespread access to a range of value files in high quantities. PC operators with encrypted data can use the 'the DXXD' string for sorting the affected information along with the free decryption solutions available from the PC security sector for decrypting that content at no charge.

Although the DXXD Ransomware makes an effort to fake its admins having connections to Windows support, any Windows user should be aware of the discrepancies between its attacks and real Windows errors. Any non-standard system prompts requesting communication through e-mail, especially free services like Protonmail may be taken for granted as being symptoms of a security compromise. Preventing the infection may require only scanning your downloads before opening them so that your anti-malware utilities can delete the DXXD Ransomware or a related installer before any encryption occurs.

Even with a new threat like the DXXD Ransomware, old knowledge and self-education on the fundamental workings of your security software can give you the solutions to deal with it on a campaign by campaign basis, with no ransom needed.

DXXD Ransomware

Threat Metric

A Security Center Whose Advice is Worth Less than Nothing

Decoding a Cheap Resolution to the DXXD Ransomware Infections

Leave a Reply