Rapid RaaS

Posted: August 8, 2018

Rapid RaaS Description

The Rapid RaaS is a family of file-locker Trojans that criminals may hire for launching campaigns of blocking media for ransoming money. While malware experts have yet to determine whether or not the Rapid RaaS is a direct update of the preexisting Rapid Ransomware campaigns, this Russian software family shows most of the same symptoms as them, including blocking your files arbitrarily. Users should store backups of their work as a precaution and use anti-malware products for eliminating the Rapid RaaS when it tries to attack.

Trojans Getting Rapid in New Regions

Threat actors with either a new variant of the Rapid Ransomware or a different program that's borrowing its brand are marketing their file-locking services towards interested criminals in the Russian Dark Web. Like most file-locking Trojans, the Rapid RaaS group offers a 'partnership' basis for all campaigning: by giving criminals access to the program without needing any programming experience, they can distribute it however they prefer, and split the ransom that the victim pays. These attacks are, as is almost always the case, most threatening for PC users who update their backups rarely or not at all.

The Rapid RaaS is a Windows-based, C++ application that conducts attacks against the user's local media, such as documents, archives, pictures, audio, spreadsheets, and other formats. It uses the AES-256 encryption in CBC mode for blocking these files, and, then, secures them with another, RSA algorithm. Malware researchers see additional evidence of the Rapid RaaS also removing the Shadow Volume Copies, which prevents the user from recovering their work by rolling back to the last Windows restore point.

Ransomware-as-a-Service delegates the distribution and installation portions of the Trojan's campaign to numerous third parties. Although its infection vectors are predictable imperfectly, the Rapid RaaS is most likely of infecting PCs that use non-secure network login credentials or after the user opens a corrupted e-mail attachment. Typical spam e-mail-based attacks may disguise the Trojan dropper for the Rapid RaaS inside of macros or other exploit-using documents, such as a fake memo or billing notification.

Slowing Down a Trojan's Pace of Extortion

Russia is becoming a prominent hotspot for Ransomware-as-a-Service and its offspring, such as the Scarab Ransomware family, or the individual campaigns of the WannaCash Ransomware, the Qnbqw Ransomware, and the FBLocker Ransomware. PC users interacting with non-secure, Russian file-hosting websites or file-sharing networks should keep in mind that media and software piracy and file-locker Trojans' installation exploits have high rates of overlapping. However, suitably updated security software frequently identifies most threats of this category and should block the Rapid RaaS.

Users should keep their files safe from encryption-based attacks by storing copies away from a Trojan's capabilities for causing harm by either encrypting or deleting the data. Traditional definitions for sufficiently secure storage options include removable devices and cloud storage. Network shares without any additional security are equally at risk as any local media. Regardless of whether or not you can save your files, you should have a suitable anti-malware product uninstall the Rapid RaaS for removing any chances of future data loss.

There is no free decryption solution for the Rapid RaaS family, whose means of infecting a PC may vary with each new criminal that 'hires' it. Since the Rapid RaaS is far from the only file-locking threat with this issue, malware experts can see no benefits coming from forgetting your backup routine.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Rapid RaaS may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.