RumbleCrypt Ransomware

Posted: August 9, 2016

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	155

First Seen:	August 9, 2016
Last Seen:	January 24, 2023
OS(es) Affected:	Windows

The RumbleCryptRansomware or 'Rumble Crypt' is a Trojan that encrypts your files and generates ransom messages that ask you to make a payment in exchange for downloading its decryption tool. Even a simple encryption algorithm contains the possibility of damaging your files irrevocably, which is why malware analysts recommend having safe backups available at all times. PC owners should refrain from rewarding the RumbleCryptRansomware's con artists with payments, if at all possible, and use anti-malware programs for uninstalling the RumbleCryptRansomware.

A New Taste of a Bad Onion Site

Web-based anonymity services may have theoretically ideal and benign goals for protecting your privacy, but, in daily usage, may fall to being tools of the threat industry. In particular, the TOR browser and associated websites (which you can identify by suffixes such as '.onion') continue being factors in how con artists receive ransom payments for misappropriated digital goods. The RumbleCryptRansomware is the latest example of this payment-processing methodology in action, with its payment infrastructure's identification taking place in the first week of August.

As a result of limited sample sizes, malware experts are unable to associate the RumbleCryptRansomware with preexisting threat families. Symptoms most likely incorporated in the RumbleCryptRansomware's payload include:

The RumbleCryptRansomware may encrypt your data (such as the contents of your Windows account folder, your desktop, or your default downloads location) with an algorithm that modifies its internal structure. Encryption always renders the file unusable until you revert the process via decryption. Most Trojans like the RumbleCryptRansomware mark the content by appending an individual extension, such as the '.locked' or '.CRYPT' tags.
The RumbleCryptRansomware may load ransom messages through your desktop, automatic pop-ups, or additional text files placed in the same locations as your encrypted information. These instructions redirect readers to the RumbleCryptRansomware's payment portal, a Tor (AKA 'The Onion Router') domain.

The RumbleCryptRansomware's current domain uses phrasings that malware experts have seen in separate campaigns, making it likely that its 'military-grade encryption' is less unbreakable than the RumbleCryptRansomware claims. Like many file encryption tactics, the RumbleCryptRansomware's domain requests payment within a short period before its con artists discard the key that normally is mandatory for decryption.

Quieting the Rumble of Young Trojans Using Old Attacks

The RumbleCryptRansomware's campaign is mildly noteworthy for its use of polite, rather than overtly antagonistic language, as well as claiming extra benefits with payments (such as the RumbleCryptRansomware self-uninstalling). The high probability of duplicity in these assertions causes malware experts still to recommend avoiding ransom payments to threat authors in all scenarios. Data recovery from a the RumbleCryptRansomware attack is most directly achievable through keeping backups out of the Trojan's capacity to encrypt, such as copies on USB drives.

Once you detect a the RumbleCryptRansomware infection, reboot your computer through any methods required for circumventing additional interference, such as switching to your operating system's built-in Safe Mode environment. Use your anti-malware products for removing the RumbleCryptRansomware, as well as threats that may have installed it. Most file encryption Trojans lack any self-installing features and depend on secondary threats for compromising new systems.

Despite its unusual politeness, the RumbleCryptRansomware is just as much a danger to your data as more overtly hostile threats like the Anatel Ransomware. Remember that paying a con artist to regain your belongings is a recovery strategy that's more likely to backfire than keeping a good backup.

RumbleCrypt Ransomware

Threat Metric

A New Taste of a Bad Onion Site

Quieting the Rumble of Young Trojans Using Old Attacks

Leave a Reply