GPGQwerty Ransomware

The GPGQwerty Ransomware is a Trojan that uses GnuPG's cryptography features for locking the files of its victims. Attacks by this Trojan also include creating ransom-themed messages asking for payments in return for the cyvbercrook's file-unlocking solution, although any users should favor alternate recovery methods, whenever they're possible. Like with any file-locker Trojan without a known, freeware solution, malware analysts suggest you deleting the GPGQwerty Ransomware with anti-malware products automatically and recovering any media from your latest backup.

Trojans Relying on the Kindness of Strangers

In spite of its prominence in the Trojan industry, malicious encryption isn't a feature that every threat enacts without some help from another. Modular designs that use plugins or accessorizing programs, along with a core of malicious software, is more often notable with banking Trojans, but our malware analysts also find it in threats like the GPGQwerty Ransomware. This recently-released Trojan is in live deployment and uses a secondary application for many of its attacks, meaning that the Trojan, by itself, has limited capabilities.

the GPGQwerty Ransomware presumes the presence of two other applications, but doesn't install or drop them, itself:

• GnuPG is the GPGQwerty Ransomware's secondary application for encrypting the files of its victim. This software is a data-confidentiality program available to any users for downloading and using for free. However, in the context of a Trojan, like the GPGQwerty Ransomware, this encryption is a viable way of blocking the user from their data, instead of blocking strangers from stealing information.
• The GPGQwerty Ransomware also abuses SDelete or Secure Delete, an app for permanently erasing data from your computer. In theory, it uses this program for removing the original, non-encrypted media.

The GPGQwerty Ransomware runs both of these apps via the Windows Command Line interface. However, since it requires the previous installation of both these applications, an independently-running the GPGQwerty Ransomware can't launch locking or deletion-based attacks. Independently, the GPGQwerty Ransomware is capable of dropping a Notepad file that displays a traditional ransom message from its threat actor. It also tries but fails to append an extension, including a random number and the '.qwerty' tag.

Resolving a Trojan Infection that Does Little on Its Own

Although the current version of the GPGQwerty Ransomware has a limited attack potential, future infections could bundle the GPGQwerty Ransomware with the additional software it needs for locking your files for a later extortion demand. The GPGQwerty Ransomware is requesting roughly one thousand USD, via the Bitcoin cryptocurrency, for restoring the work of any victims. The unlikelihood of any decryptors being free for the GPGQwerty Ransomware's method of locking data may force a user to restore from a backup or take the gamble of paying, which may give them nothing back.

Some security utilities are identifying the GPGQwerty Ransomware as being a variant of Hidden Tear, but our malware experts currently estimate that there are no connections between that family of 'free' file-locking software and the GPGQwerty Ransomware. For now, confirmation of live GPGQwerty Ransomware attacks exists for multiple victims, although the strategies for infection are unknown. Allow your anti-malware programs to analyze potential threats, such as e-mail attachments, and delete the GPGQwerty Ransomware before it can be a danger to your locally-saved media.

The nature of the GPGQwerty Ransomware's design implies that any installation exploits also will include capabilities separate from the Trojan for installing extra software without your permission. One security problem often escalates into multiple counts of infections or related consequences of an attack, and the GPGQwerty Ransomware is an example of why it's important to know what you're installing.