Fatboy Ransomware

The Fatboy Ransomware is a Ransomware-as-a-Service or RaaS Trojan that threat actors can 'hire' for conducting separate campaigns that encrypt their victims' files. Its features include significant support for the ransom-demanding side of the payload, which encourages you to pay Bitcoins to restore any blocked content. PC users should use standard anti-malware applications for uninstalling the Fatboy Ransomware and contact trusted anti-malware researchers for any other, necessary recovery help.

The Weight of Russian Trojans Slamming Down on Your Files

Even with the relatively easy access to the threat industry that's afforded by families like Hidden Tear, the market for file-encrypting threats continues to have room for 'lone wolf' products with custom features. Russia is, unsurprisingly, the birthplace of one of the newer independent Trojans malware experts can confirm in May: the Fatboy Ransomware. The Trojan has received additional marketing support from other threat actors already and appears to be ready for live deployment.

The Fatboy Ransomware's existence first was verifiable on an underground forum promoting it as a traditional RaaS. Independent con artists use RaaS Trojans like the Fatboy Ransomware, either on a rental basis or, in the Fatboy Ransomware's case, by giving the original authors a percentage of their ransom collections. The Trojan shows symptoms to its victims highly similar to those of the Critoni Ransomware (AKA CTB-Locker) but isn't a direct derivative from that family. Unlike CTB-Faker, the Fatboy Ransomware uses real file encryption for locking your local files.

The Trojan's payload uses the AES encryption and a second layer of the RSA to protect the keys it generates from the first level of encoding. After blocking the PC's files, the Fatboy Ransomware loads a screen-locking, HTA window with multi-language support for its Bitcoin-based ransoming demands. Further interactions redirect you to a series of notably verbose, and highly informative Web pages that the Fatboy Ransomware's author uses for describing the encryption and ransoming process at length.

These windows also include a clever social engineering trick: they claim that the decryption process is linked to the ransom transaction automatically and will occur without any manual intervention from the threat actors.

Trimming Bad Boy Trojans Down to Size

The Fatboy Ransomware's authors claim that the Trojan can lock thousands of formats' worth of data, among other features meant to appeal to interested con artists, such as instantaneous money transfers and, most unusually, an automatic ransom-adjusting feature deriving from the so-called 'Big Mac Index.' Overall, its feature set makes the Fatboy Ransomware a potentially versatile threat capable of deploying equally effectively throughout all continents.

Malware analysts continue recommending that any victims look for free data recovery options, when possible, instead of paying ransoms that may not have the intended effect. Well-known anti-malware sector research Michael Gillespie is offering limited assistance with potential decryption solutions currently. Backups also are effective consistently at giving users file-restoring strategies that avoid the technical difficulties sometimes found in decryptors.

The marketing campaign for the Fatboy Ransomware is extremely new but highly detailed and professional, with potential appeal to many threat actors. If you don't want to risk your files becoming a profit margin for Russian threat authors, you may want to give your anti-malware products a chance to analyze your downloads and, potentially, remove a the Fatboy Ransomware installer.