SAD Ransomware

Posted: November 7, 2017
Threat Metric
Threat Level: 10/10
Infected PCs 19

SAD Ransomware Description

The SAD Ransomware is a file-locker Trojan that can block the media on your PC by encrypting it through an AES algorithm. The Trojan also creates multiple formats of ransom notes that request Bitcoins in payment for giving you a decryption tool that could retrieve your files, and may attempt to spread through local networks. Have your anti-malware products quarantined or delete the SAD Ransomware when necessary, and use backups to keep this threat from causing any permanent data loss.

The Trojan that's Happy to Make Your Files SAD

How Trojans offer to communicate with their victims can be both a very identifying characteristic and one that impacts the success rates of their authors' intended crimes directly, such as extorting cryptocurrency or collecting data. One of the newest, file-locking threats malware experts can confirm for being fully functional, the SAD Ransomware is offering several different, redundant formats of ransom messages to the individuals it attacks. Each message includes sufficient details to inform the victim on how to pay the threat actor, making the cybercrook's demands impossible to overlook.

The SAD Ransomware is one of the relatively rare sub-types of file-locking Trojans to not be a direct copy-and-paste of freeware like Hidden Tear or a Ransomware-as-a-Service family. It employs the AES-256 encryption for blocking different formats on the user's computer, including both the usual targets (such as JPG pictures) along with atypical choices (for example, INI configuration files). The SAD Ransomware also generates an alphanumeric string for the victim's ID number and appends it to the names of all locked content.

The SAD Ransomware uses a comprehensive and high-redundancy method of displaying its offers to sell the victim a file-unlocking decryption application in return for Bitcoins. The Trojan displays messages through a hijacking of the desktop's wallpaper, a standard HTML page, an advanced HTA page with interactive GUI elements, and a simple TXT text file. Malware researchers find the contents of all of the above instructions to be non-identical but also including the same details on paying the cryptocurrency to restore your files, in theory.

Getting the Sadness out of Your PC

Along with its unconventional choices in persuading the individuals it attacks, the SAD Ransomware also has two features of significance, relative to other Trojans with file-locking functions. Unlike most threats of its kind, the SAD Ransomware generates a default system 'beep' before it begins encoding and blocking the files, which could give the user time to respond to the attack. The SAD Ransomware also includes what may be the skeleton of an attempted 'worm' feature by creating duplicates of its executable on any network-shared folders. However, since the SAD Ransomware isn't a complete worm and can't install itself without intervention from another party, other users will need to run this file manually to infect their PCs.

Victims of any attacks should try recovering their files through secure backups, if possible, or contact security researchers experienced with threats of this category for insight into its cryptography methods (and the chances of decoding them). Paying a Bitcoin ransom has no guarantee of helping you unlock your files, and that format of currency includes no legal protections that would let the 'customer' trigger a refund for fraud. Malware experts also recommend disabling network access to other PCs until after your anti-malware products have deleted the SAD Ransomware, including any additional copies it may generate.

The SAD Ransomware's payload appears to be either incomplete or in a state of flux, indicating that its threat actors may try developing it further than its present state. However, the Trojan is already showing more than sufficiently viable attacks against not just one user's files, but the data of an entire local network, such as those managed by private businesses or governments.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to SAD Ransomware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Related Posts

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.