Purge Ransomware

The Purge Ransomware is a Trojan that blocks your files by encrypting them and uses pop-ups to ask for money for their restoration. You can restrict the scope of most file encryption-based threats by keeping sufficiently-secure backups of their information. Although you should use anti-malware tools for uninstalling the Purge Ransomware, they can't perform decryption functions, and malware analysts encourage exercising preventative security measures particularly, when possible.

When 'the Purge' Comes for Your Savings

Although purging is a term one might associate with everything from eating disorders to cathartic, spiritual self-cleaning rituals, a new threat campaign soon may make it most closely linked to Trojan-based theft. The Purge Ransomware is a recently-detected file encryption Trojan with claims of using RSA encryption to lock the information of its victims. The campaign also incorporates social engineering techniques malware experts saw popularizing themselves in old attacks.

The Purge Ransomware uses a simple file-scanning content to isolate content not necessary for the basic maintenance of the Windows OS, such as JPG images. The Purge Ransomware then uses an encryption algorithm malware experts still are identifying to encrypt each file and adds a '.the Purge' extension to the end of each name. These extensions don't replace any preexisting extensions, which remain intact.

Malware experts also found the Purge Ransomware's ransom note, which it loads after the encryption routine, to be of particular interest. While shallower Trojans (such as most versions of the Troldesh Ransomware) restrict themselves to displaying an e-mail address, the Purge Ransomware provides an interactive HTML pop-up. This Web page offers customizable contact addresses (including a Bitmessage-based alternative to conventional e-mail) and a personalized ID field. It also includes multiple time-based warnings regarding not paying the Purge Ransomware's ransom, after which its administrators claim they will delete the key required for restoring your encrypted content.

Purging an Attempt at Extortion from a PC

The Purge Ransomware embodies the dualism inherent in any file encryption attack. Although a remote threat actor may claim that no alternatives can restore your data safely, the same ransom messages also warn against taking even minor delays before sending payments. The continual popularity of the Purge Ransomware and other threats of its category also is a clear sign for PC owners to continue keeping stringent backups of any important information, with which they can ignore decryption as a supposed necessity.

Although anti-malware products traditionally don't provide decryption options, some reputable PC security organizations do offer decryption services for major Trojan families at no charge. However, these services aren't always available, and malware experts recommend, instead, taking steps to keep the Purge Ransomware from being installed. Active anti-malware solutions also may remove the Purge Ransomware before it finishes encrypting your hard drive, when relevant.

The work put into the Purge Ransomware's extortion message is more than just an attempt to collect money efficiently, but also a sign of con artists needing to force their victims into self-destructive actions with a minimum of forethought. Taking a moment to pause and inspect your security and recovery options before paying a threat author may pay more than one would assume.

Technical Details