H@RM@ Ransomware

The H@RM@ Ransomware is a file-locking Trojan that's an update of the Wanna Scream Ransomware. The H@RM@ Ransomware can block media files with secure encryption and holds them as hostages while displaying a ransom note. Users must have backups on other devices for restoring any locked media, and most PC security solutions will identify and delete the H@RM@ Ransomware correctly.

Two-Bit Trojan Updates Done Hastily

The small family of file-locker Trojans, Wanna Scream Ransomware – named as a riff off of the well-known WannaCryptor Ransomware - has another version out already. Judging it by its ransom note might lead users into assuming that it's part of various, unrelated families, thus showing the importance of not identifying a Trojan book by its cover. Malware researchers also find some details in the H@RM@ Ransomware's executable that implies either one of its long-term, system-persistent disguises or a possible installation scheme.

The H@RM@ Ransomware blocks most media formats on Windows systems with AES-256 encryption, a long-standing favorite among file-locker Trojans. Similar to most Ransomware-as-a-Services today, the H@RM@ Ransomware includes an extension-adding feature that marks each non-opening document, picture, or other files with an ID, a bracketed e-mail for speaking with the threat actor and a campaign-custom string.

Malware analysts find that the ransom note that the H@RM@ Ransomware uses has no significant updates from the Wanna Scream Ransomware version, which uses a template in families like the Crysis Ransomware and others. It also continues identifying itself by the 'Wanna Scream' title while it asks for e-mail negotiations over the ransom for the hacker's file-unlocking service.

The Harm that Comes of Trusting a False Defender

There isn't a free decryption service for the H@RM@ Ransomware's family, and users may find their files unrecoverable by the Restore Points or other backups that the Trojan could wipe. Malware experts find at least one viable infection method or disguise in current samples: the fake 'Defender' name implies that the H@RM@ Ransomware's installer is a Windows Defender update. Windows users should remember the value of acquiring updates from official sources only, especially when it comes to patches for widely-used, core security software.

Malware researchers recommend saving one's backups to other devices for maximizing the data recovery options available after a file-locker Trojan attack. Paying as per the H@RM@ Ransomware's HTA or TXT message doesn't give the victim anything in return necessarily since threat actors widely vary in trustworthiness and competency. Infection vectors likely of circulating fake software updates like a false Windows Defender patch can use typo-squatting websites that imitate Microsoft.com, compromised advertising networks, or, rarely, even torrents.

Fortunately, trustworthy PC security products prove themselves capable of identifying the Wanna Scream Ransomware family and its variants on sight. Users with traditional security solutions can remove the H@RM@ Ransomware without a window for experiencing file loss through its encryption.

In at least two ways, the H@RM@ Ransomware reminds anyone afflicted by it that taking files at their appearances can hurt more than help. Superficial elements like ransom notes can lead victims towards incorrect conclusions, just like fake patches can instigate data sabotage on a scale that's considerable even for enterprise-scale networks.