QP Ransomware

The QP Ransomware is a file-locking Trojan that blocks your media by moving it into a compressed archive and locking it with a password. The users should ignore the ransoming instructions that this threat gives in its local Web page and use backups or other alternatives for restoring their work. Most anti-malware programs proven effective at removing file-locking Trojans of other families previously should delete the QP Ransomware safely.

The Abuse of Freeware in the Trojan Market

The old strategy that malware researchers found in the 2017's '.7zipper File Extension' Ransomware and the 2018's NazCrypt Ransomware is renewing itself for the next year, in turn. The latest release of a file-locking Trojan using the 7-Zip's archival technology for harmful ends is the QP Ransomware, which is so similar to the old threats that it's open to question as to whether or not it's an update of one of them. The author's use of freeware for these attacks, while convenient for him, does nothing for making the blocking of the data any less restrictive to those who reside on the other end.

The QP Ransomware is a Windows application that doesn't employ individualistic file-encrypting attacks that persist as the standard for families of competitors like the Globe Ransomware, the Jigsaw Ransomware or the Scarab Ransomware. Instead, it drops a version of the 7-Zip archiving software (a free alternative to WinRAR or WinZip) on the system and creates an archive for storing your files. It, then, searches for media such as Word or Adobe PDF documents, spreadsheets, images, databases or music, and moves them into the archive, which it locks with a password. Malware experts haven't determined yet whether this password is hard-coded and susceptible to cracking possibly or secure and generated randomly.

The QP Ransomware also adds 'aes' extensions onto the names of these files, although, since they're inaccessible and moved from their original locations already, it's open to question why the program bothers doing so. However, it is worth no single thing that this choice raises the threat's similarities with the payload of the older '.7zipper File Extension' Ransomware. Until the user acquires the password or restores from a backup, all of their files remain unusable, just like the more traditional encryption attacks of the more numerous, non-archive-based, file-locking Trojans.

Stopping a Disservice Towards Data Compression Products

Just like its other features borrow from techniques from the past, the QP Ransomware uses a much-copied Web page from various file-locking Trojans' campaigns for its ransoming note. Paying this Bitcoin ransom doesn't instigate any form of decryption or password recovery necessarily, and threat actors are unreliable at providing the promised services in similar campaigns. On the other hand, the victims may benefit from the threat actors' offer of a free 'sample' for retrieving a handful of files.

Malware researchers have yet to confirm the QP Ransomware's deleting the Shadow Volume Copies that serve as being Windows' default means of recovering files through its Restore Points feature. While this possibility is suggestive of one recovery solution, most users should protect their work from the worst encryption attacks by backing it up to another device in its entirety. A traditional anti-malware suite or AV scanner should delete the QP Ransomware automatically in nearly all cases, as well.

There's no form of free innovation that criminals can't put to illicit purposes as long as it's profitable. By doing your part and refusing the QP Ransomware's ransoming demands, you help cut down on future security risks, if not necessarily save your files immediately.