Grethen Ransomware

The Grethen Ransomware is a file-locking Trojan of an unknown family. It can block your files by encrypting them, change their names and extensions, and deliver ransom notes in multiple formats. Users always should have appropriately secured backups as a precaution against Trojans with these payload types. In worst-case scenarios, users can uninstall the Grethen Ransomware safely with anti-malware tools, although their work will remain encrypted.

Trojans Making It Hard to Tell What They've Taken

Psychology is just as important as technical coding skills for the success of some Trojans. The Grethen Ransomware, a new entry into the file-locking classification of these threats, has an indeterminate lineage but uses well-known tricks for convincing users into paying its ransoms. The bargaining chip in its demands is the files that it's holding hostage, although which ones might be up to the memory and guessing skills of the victims.

The Grethen Ransomware uses encryption for blocking files of formats such as documents and pictures, along with other media. Besides appending an extension to their names – which is true of nearly all file-locking Trojans – the Grethen Ransomware also replaces the filenames with semi-random strings and inserts a bracketed e-mail. The obfuscation of the file's identity is a possible intimidation tactic from the threat actor and makes identifying the content that's being held hostage more difficult. However, it doesn't affect the encryption that's stopping the files from opening.

While malware researchers find broad similarities between the Grethen Ransomware and Ransomware-as-a-Service families like the Scarab Ransomware and AES-Matrix Ransomware, the Trojan's heritage is unconfirmable, for now. Victims should avoid running decryptors blindly on their media, which may cause more damage and make the file irreparable. Always test decryptors on 'spare' copies of any data.

Paying Problems that might not Go Away

The Grethen Ransomware creates both TXT and HTA notes (the former, as a text message, the latter, as a pop-up window) with its demands for the decryptor. Such ransom methods, usually, abuse cryptocurrencies and voucher cards that make refunding impossible or impractical. Since most Ransomware-as-a-Service families similar to the Grethen Ransomware use many client administrators, there's no certainty of the victim's paying a criminal with any sense of long-term business integrity or trustworthiness.

With the dangers of a ransom so high and encryption being, often, permanent, users should implement protections for their computer against the Grethen Ransomware and similar, file-locking Trojans. Avoiding suspicious download sources like torrents, disabling browser scripts, using strong passwords, and scanning all e-mail attachments are all, potentially helpful. Malware analysts can only confirm this threat on Windows systems and recommend Windows-compatible anti-malware products for removing the Grethen Ransomware, although file-locking Trojans are available for most OSes.

The Grethen Ransomware can't hurt those who don't give it an ample opportunity for causing harm. A good backup and mindfulness while surfing the Web will do much for crippling its ransom collections.