‘Los Pollos Hermanos’ Crypto Virus

Posted: May 11, 2015

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	157

First Seen:	May 11, 2015
Last Seen:	December 27, 2022
OS(es) Affected:	Windows

The 'Los Pollos Hermanos' Crypto Virus is a file encryptor that targets files on the infected PC with a data-scrambling attack, afterward displaying a ransom message requesting payment for the restoration of your lost information. Although the 'Los Pollos Hermanos' Crypto Virus uses a whimsical ransom note referencing pop culture, in all other respects, the 'Los Pollos Hermanos' Crypto Virus is identical to prior file encrypting Trojans already surveyed by malware experts. Deleting the 'Los Pollos Hermanos' Crypto Virus with appropriate anti-malware equipment and avoiding any payment of its ransom are the two recommended solutions to an infection.

Where Threats are Always Cooking

The 'Los Pollos Hermanos' Crypto Virus gets its name from the fictional restaurant logo incorporated into its ransom message, which is familiar to viewers of the show Breaking Bad. Although the in-show Los Pollos Hermanos chain closes near the end of the show's run, the 'Los Pollos Hermanos' Crypto Virus only has recently begun seeing distribution in the wild. So far, malware experts estimate that the 'Los Pollos Hermanos' Crypto Virus is being distributed primarily to Australian victims, and its stock ransom note requests a payment in Australian Dollars (AUD).

The 'Los Pollos Hermanos' Crypto Virus is an estimated member of Crilock or CryptoLocker, and may distribute itself via third-party Trojans favored by those families. Once introduced to a new PC, the 'Los Pollos Hermanos' Crypto Virus scans the system for 'valuable' file formats, including text documents, images and movie files. The Trojan modifies these files with an AES encryption standard, which has no known means of being unlocked via brute-force techniques.

After making your data unusable, the 'Los Pollos Hermanos' Crypto Virus then loads an additional image containing the ransom request, the restaurant logo, and a related e-mail address, which also references Breaking Bad. The message demands a minimum of $450 AUD for the restoration of any encrypted files. However, as always, malware experts must warn that there is no guarantee that any real decryption services will be provided.

Slow-Cooking a Trojan out of Your Hard Drive

Like most ransomware, the 'Los Pollos Hermanos' Crypto Virus seeks to feast on money acquired through attacking random computers. However, the 'Los Pollos Hermanos' Crypto Virus has no notable protection from the standard security protocols that are effective against other threats of the same type. Remote file backups can prevent your file data from being damaged permanently by a 'Los Pollos Hermanos' Crypto Virus's encryption attack. Like most file encryptors, the 'Los Pollos Hermanos' Crypto Virus also is not a technical virus, and can't infect your file en masse with its code for reproductive purposes. Restarting in Safe Mode and scanning your PC with updated anti-malware tools should allow you to detect and remove a 'Los Pollos Hermanos' Crypto Virus with no further problems.

Shared USB devices, compromised wireless networks, and unsafe downloading sites are some of the usual distribution methods for variants of CryptoLocker. Typically, you will not find a 'Los Pollos Hermanos' Crypto Virus without support from other Trojans, such as Zbot, although the nature of the threats in question may differ between two attacks. Australian residents especially are advised to keep watch all of the usual infection vectors for signs of this Trojan's distribution, although other regions also may be at risk in future campaigns.

Technical Details

Additional Information

The following messages's were detected:

#	Message
1	Your important files have been encrypted: photos, documents, videos, etc. If you want to decrypt your files you must pay the fee of $450 AUD Failure to pay within the specified time will mean you must pay $1000 AUD For support related inquiries contact: theonewhoknocks[edited]@mailinator.com