EV Ransomware

Posted: August 23, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	16

First Seen:	August 23, 2017
Last Seen:	September 10, 2021
OS(es) Affected:	Windows

The EV Ransomware is a Trojan that locks the files related to WordPress websites. Because the EV Ransomware runs on a manual user interface, users can protect their sites by preventing remote attackers from gaining access to their accounts through the usual methods, such as brute-forcing poor passwords. The EV Ransomware doesn't come with its decryptor; accordingly, victims should quarantine or remove the EV Ransomware with anti-malware tools and seek alternative recovery solutions.

A New Wrinkle in Web Design for WordPress

The popular blogging service of WordPress becomes a subject of interest to threat actors occasionally. Many of them use attacks like those in the Cridex Trojan campaign to further distribute threatening software after compromising a blog. However, for other cases, the WordPress site is the victim. Unsurprisingly, recent attacks also are including encryption features that let a con artist hold digital content hostage for cash, such as with the latest EV Ransomware.

The EV Ransomware runs in a format similar to that of the Crypt12 Ransomware and similar Trojans that the threat actors introduce after compromising a system remotely. After hacking the WordPress account, they run the EV Ransomware and use it to encode Web design-related files such as CSS or PHP. The result is the entire website is held hostage in the meantime while the threat actor delivers ransom-related demands to the real administrator.

The EV Ransomware's name derives from the '.ev' tags it appends to the names of the locked files. Malware experts also confirmed that the EV Ransomware uses a simple variant of AES as the encryption algorithm, although the remote attacker customizes the associated key. The Trojan also may not block all files on the website's storage and appears to be incomplete (but is still capable of causing significant file damage).

The Side Effects of Pressuring WordPress Users

Along with showing why it's important to practice good security habits for your online accounts, the EV Ransomware also is highly demonstrative of the issues with submitting to a ransoming demand. The EV Ransomware doesn't include a decryption component and, for now, its threat actors are only offering to transfer the key, not a decryption application, to their paying victims. While free decryption with the help of third-party security researchers may not be impossible, malware analysts advise storing remote backups to prevent the EV Ransomware attacks from causing any damage that you can't undo.

The EV Ransomware isn't meant to be run by the website admin, and its presence also entails a threat actor having remote access to the WordPress blog's account. Change your account passwords and related security details as soon as possible to eliminate any future attacks. Professional anti-malware products also should detect and delete the EV Ransomware in any variant formats before it becomes a threat to your files.

Easy-of-use services like WordPress are popular both with newcomers to Web design and con artists hoping to exploit them. However, being a humble blogger doesn't have to mean using easily-broken passwords or other, equally poor security habits that could let threats like the EV Ransomware make money off of you.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

C:\Users\<username>\Desktop\PC malware samples\just.exe

File name: just.exe
Size: 3.81 MB (3814912 bytes)
MD5: 83928680592d674bfe0b420a20e7fbb6
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: C:\Users\<username>\Desktop\PC malware samples\just.exe
Group: Malware file
Last Updated: September 10, 2021