Nvram Ransomware

The Nvram Ransomware is a file-locking Trojan that's from the Ransomware-as-a-Service family of the Crysis Ransomware (or the Dharma Ransomware). The Nvram Ransomware represents a significant danger to your files, archetypal media formats, especially, which can suffer locking automatically. Letting anti-malware services uninstall the Nvram Ransomware and possessing secure backups for recovering are the preferable solutions to infections.

Extortionists Teasing with Hardware References

The in-flux status of the fast-growing Ransomware-as-a-Service families is, mostly, concerning internal encryption, file markers, contact addresses, and thematic aspects like extensions. In the newest Crysis Ransomware offspring of the Nvram Ransomware, the latter is taking on an odd turn that suggests a rising interest in alternative persistence exploits. Hopefully, the Nvram Ransomware's name is a bluff – although malware researchers find its file-locking attacks sufficiently threatening to local data, even so.

The Nvram Ransomware is a variant of the Ransomware-as-a-Service or RaaS family that, like the Asus Ransomware, the CMD Ransomware, the RSA Ransomware, or the 1BTC Ransomware, uses RSA-secured, AES encryption for blocking content. It's more likely to target non-essential, but theoretically valuable, formats, such as JPG, DOCX, MP4, XLS or TXT. As per usual, it has an individualized extension that it gives these newfound 'prisoner' files: 'nvram.'

Of note is that many Crysis Ransomware variants include technical references or gags in their name, and, in the Nvram Ransomware's case, the name hearkens to non-volatile random-access memory. This form of RAM is the foundation of critical startup components like the BIOS typically. It suggests that the Nvram Ransomware's admin or the criminals running the family are cultivating an interest in boot-kernel rootkits. Fortunately, the samples of the Nvram Ransomware that malware experts are seeing show no drastic changes in the Nvram Ransomware's overall structure, which remains that of a conventional, 32-bit Windows program of modest size.

Remembering What to Do against Memory-Mocking Trojans

While the foreboding theme of the Nvram Ransomware's implies future problems with this family of Trojans, the Nvram Ransomware's current capabilities in the present day make itself into a sufficient danger for any unprotected user's files. The program continues removing the Shadow Volume Copies and, by doing so, depriving the victim of a Restore Point recovery. Its encryption also remains irreversible without the key that its threat actor is holding for ransom.

Besides the incredible benefit of having a backup on another, safe device, users can implement precautions for keeping the Nvram Ransomware's installers from arriving through the usual sources. Illicit downloads are likely to bundle with the Nvram Ransomware or carrying its executable with a fake file name. Drive-by-downloads may use your browser's Flash, Java, or JavaScript features against it – which users can disable. Open RDP and other unsafe network configurations also can be 'invitations' for file-locking Trojans from the Nvram Ransomware's family or others.

While malware experts are glad that the Nvram Ransomware is showing any substantial upgrades in its system persistence exploits, hostile data encryption isn't a problem that anyone can afford underestimating. Whether or not the Nvram Ransomware's campaign has anything to do with non-volatile RAM, it's a potentially-lethal pest for digital media globally.