RaRuCrypt Ransomware

The RaRuCrypt Ransomware is a Trojan that locks your files using the WinRAR data-compressing application. Although its threat actors ask for a ransom to restore your media, their negotiating channel, currently, is defunct, due to Terms of Service violations. Anti-malware products can help block or uninstall the RaRuCrypt Ransomware to protect your files, and a variety of free options can help with restoring them.

The Ransom Attempt that's Getting Ahead of Itself

Threat actors without much in the way of state-level resources often resort to imperfect or inexpensive infrastructure for supporting their campaigns. While it's not always necessary to have a full-fledged botnet facilitating the attacks of, for instance, a file-locking Trojan like the RaRuCrypt Ransomware, the absence of such a network, sometimes, creates problems. The RaRuCrypt Ransomware's campaign already appears to have sabotaged its ability to profit via ransoms.

The RaRuCrypt Ransomware is a Russian program by Albert Mikhailovich (or 'Альберт Михайлович'), a new threat actor to the industry of file-locking Trojans. Similarly to the WinRarer Ransomware or the .7zipper File Extension' Ransomware, RaRuCrypt uses data-compressing freeware for locking the files of its victims. Its attacks target formats such as DOCs, JPGs, MP3s, and PDFs by placing each one into its own, individual RAR archive.

When it completes this file-locking attack, the RaRuCrypt Ransomware also generates a series of Notepad files in the same folders. The messages ask the users to pay 200 Russian rubles (equal to three and a half US dollars) for the unlocking password. However, the most diverging trait in the note is how its threat actors negotiate: via the VKontakte social media service. Malware experts note that the current profile that the Trojan promotes is already locked for Mikhailovich's breaking the website's ToS.

Digging Your Files out of Someone Else's Archives

The low-effort approach of the RaRuCrypt Ransomware's ransoming communications also encompasses the security, or lack thereof, of its encryption and file-blocking attack. Victims can run WinRAR and open their 'locked' files with the 'S?{DCO^C!{L@CR^+<7E}2' password, which is non-dynamic. Most file-locking Trojans use more secure cryptography, such as a combination of the AES and RSA algorithms for preventing this straightforward data recovery. The RaRuCrypt Ransomware is a 32-bit Windows program of under a megabyte, and malware experts aren't able to verify which infection methods Mikhailovich uses for distributing the Trojan. Typical cases of file-locking Trojan attacks, often, trace back to the user opening corrupted e-mail attachments, visiting a website hosting an exploit kit, downloading illicit programs, or using a network with a high-risk password (such as 'admin'). Anti-malware products provide features for protecting your PC against all but the last of these attacks and also can delete the RaRuCrypt Ransomware securely. Running a frugal Trojan campaign comes with different costs than financial ones. Despite its significant limitations, the RaRuCrypt Ransomware is a real danger to your files, and even the smallest patch could make known solutions to its attacks useless. Users should, accordingly, emphasize avoiding the infections and storing their media safely.