Ramsomeer Ransomware

Posted: January 11, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	84

First Seen:	January 11, 2017
OS(es) Affected:	Windows

The Ramsomeer Ransomware is a Trojan most likely built off of DUMB, a GitHub-hosted 'proof of concept' for file-encrypting threats. The Trojan blocks your files with encryption and launches a window soliciting ransoms before supposedly using a corresponding decryption solution to restore them. Since this Trojan is not yet in wide deployment, PC users can protect themselves by having anti-malware products for removing the Ramsomeer Ransomware by automated means whenever it tries to infect their systems, as well as by making backups not saved to the same machine.

Turkey Starts the New Year with New Trojans

A concise and on-point message is one of the bulwarks of social engineering, and con artists can find their campaigns profiting from such techniques as much as law-abiding citizens. With the Ramsomeer Ransomware, malware experts see a new Trojan that delivers all the bare bones details of its attacks, along with additional threats, to ease the ransoming process. Like any suitably-paranoid threat actor, the Ramsomeer Ransomware's author is still using the favorite cryptocurrency of Bitcoin, making sure that taking the payment comes with no obligations on his part to honor the agreement.

The Ramsomeer Ransomware seems to be a derivative of DUMB, a file-encrypting Trojan whose author apparently developed solely as a 'proof of concept' without deploying it. Other sources report possible ties with the Android smartphone-locking Trojan Lockerpin, although malware experts can't confirm this speculation. Aside from the details of its creation, the Ramsomeer Ransomware is in development with components targeting both Turkish and English speakers. It encrypts your files with a XOR algorithm and launches a Web application-based ransom message.

The Ramsomeer Ransomware's extortion notice explains the basic situation of the infection, as well as delivering clear payment instructions (0.3 Bitcoins, equal to 236 USD) and a time limit of two days. Victims who ignore the latter will no longer have access to the decryption key, making any files not recoverable via other methods (such as backups) unreadable in perpetuity. The decryption feature also is built into the same window directly, emphasizing ease of use.

Struck with a Trojan Easily Solved

There are no current decryptors for the Ramsomeer Ransomware on offer from third parties, but the open-source nature of its associated threats makes it more possible than not that a freeware solution is forthcoming. However, for most PC users, malware researchers always endorse using thorough and rigorously updated backup strategies for counteracting all threats of this classification. Being able to restore your files from another location make any encryption damages the Ramsomeer Ransomware causes irrelevant and allows you to ignore the forty-eight-hour limit to resolve the security issue in your own time.

Always update your anti-malware solutions to help them detect newly-produced threats like the Ramsomeer Ransomware with minimal inaccuracies. Infection exploits that malware analysts also recommend being cautious around include torrent downloads, e-mail attachments, and script-based downloads that trigger through your browser automatically. Most comprehensive anti-malware products should provide adequate protection from all of these threats and remove the Ramsomeer Ransomware without its encrypting any content.

There's nothing 'dumb' about being without backup plans after a Trojan attacks your files. Readers should remember that good defense plans against Trojans like the Ramsomeer Ransomware always entails some preventative maintenance.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 38.4 KB (38400 bytes)
MD5: d9eba5d7d790ee4d6550c141d2df84e6
Detection count: 55
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: January 17, 2017