EnCrypt Ransomware

The EnCrypt Ransomware is a Trojan that locks your files with an encryption cipher so that it can sell you the solution to restoring them. Decoding them through other methods may be possible, but users are recommended to backup all data that's too valuable to risk losing it to file-encrypting threats. Monitor your e-mail and network security and use anti-malware products for blocking or uninstalling the EnCrypt Ransomware as is appropriate.

A Hint of Onion in the Next Trojan Campaign

While threat actors can be industrious, they also see the value in not re-imagining the wheel, and are just as happy to use pre-existing structures and services as they are to create new ones. The EnCrypt Ransomware offers another data point confirming how modern, file-encoding attacks are using anonymity services like TOR to protect their identities and cash transactions. The implied semi-automated nature of the ransom also could encourage victims to pay more promptly instead of searching for other solutions to an infection.

The EnCrypt Ransomware's family, if any, is unknown, and malware researchers haven't verified the encryption cipher it uses. In other respects, however, the EnCrypt Ransomware is very similar to members of previously examined families, like Hidden Tear, Jigsaw Ransomware or EDA2. Its attacks and symptoms may include:

• The EnCrypt Ransomware creates a background process to scan for files of particular formats and in specific locations, such as documents or the contents of the user's desktop. Appropriate content is encoded with a cipher to prevent them from opening.
• The EnCrypt Ransomware appends '.en' extensions onto every name for any media it locks, which may or may not replace any previous formatting tags ('document.doc' may become 'document.doc.en' or 'document.en').
• The Trojan uses text-based ransoming messages to sell the victims a possible decryption key for restoring their files and may supplement the note with other alerts, such as an image replacing their desktop's background.

In addition to the above, usual features, the EnCrypt Ransomware also conducts its decryption services through a TOR (initially known as The Onion Router) website. This site allows the victims to input their ID and the Bitcoin transaction data to confirm the money transfer and then, supposedly, get their files unlocked. This support feature is one that malware researchers often sees with RaaS (AKA Ransomware-as-a-Service) Trojans, which divides the distribution campaigns and the original programming into separate groups of threat actors.

Suppressing the Aroma of an Onion-Assisted Extortion

Much remains to learn about the EnCrypt Ransomware, which began being identified and analyzed only recently. RaaS campaigns can be more unpredictable than ones using the same threat actors for each attack, and the EnCrypt Ransomware has the potential to spread through numerous means, including spam e-mails, brute force hacking, and exploit kits. Disable risky content, such as JavaScript or macros, when they're not necessary, to reduce the risk of system compromises.

With so many of its symptoms limited to showing after its data-damaging attacks, users should try to block the EnCrypt Ransomware before it encrypts content, instead of removing it after the fact. Users can update their security software as appropriate to allow them to identify new threats as soon as possible, and submit samples of quarantined Trojans or encrypted media to anti-malware researchers for developing new decryption solutions. By default, conventional anti-malware technology should delete the EnCrypt Ransomware and prevent any encryption from happening, unless the remote attacker can disable these defenses manually.

TOR was, like many products, built for fulfilling a perceived, ideological need for privacy. However, con artists very prone to respecting philosophical ideals and, when given an online tool like an anonymous browser, are more likely than not to exploit it for funneling money with help from programs like the EnCrypt Ransomware.