SAD Ransomware

Posted: November 7, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	19

First Seen:	November 30, 2018
Last Seen:	December 20, 2018
OS(es) Affected:	Windows

The SAD Ransomware is a file-locker Trojan that can block the media on your PC by encrypting it through an AES algorithm. The Trojan also creates multiple formats of ransom notes that request Bitcoins in payment for giving you a decryption tool that could retrieve your files, and may attempt to spread through local networks. Have your anti-malware products quarantined or delete the SAD Ransomware when necessary, and use backups to keep this threat from causing any permanent data loss.

The Trojan that's Happy to Make Your Files SAD

How Trojans offer to communicate with their victims can be both a very identifying characteristic and one that impacts the success rates of their authors' intended crimes directly, such as extorting cryptocurrency or collecting data. One of the newest, file-locking threats malware experts can confirm for being fully functional, the SAD Ransomware is offering several different, redundant formats of ransom messages to the individuals it attacks. Each message includes sufficient details to inform the victim on how to pay the threat actor, making the cybercrook's demands impossible to overlook.

The SAD Ransomware is one of the relatively rare sub-types of file-locking Trojans to not be a direct copy-and-paste of freeware like Hidden Tear or a Ransomware-as-a-Service family. It employs the AES-256 encryption for blocking different formats on the user's computer, including both the usual targets (such as JPG pictures) along with atypical choices (for example, INI configuration files). The SAD Ransomware also generates an alphanumeric string for the victim's ID number and appends it to the names of all locked content.

The SAD Ransomware uses a comprehensive and high-redundancy method of displaying its offers to sell the victim a file-unlocking decryption application in return for Bitcoins. The Trojan displays messages through a hijacking of the desktop's wallpaper, a standard HTML page, an advanced HTA page with interactive GUI elements, and a simple TXT text file. Malware researchers find the contents of all of the above instructions to be non-identical but also including the same details on paying the cryptocurrency to restore your files, in theory.

Getting the Sadness out of Your PC

Along with its unconventional choices in persuading the individuals it attacks, the SAD Ransomware also has two features of significance, relative to other Trojans with file-locking functions. Unlike most threats of its kind, the SAD Ransomware generates a default system 'beep' before it begins encoding and blocking the files, which could give the user time to respond to the attack. The SAD Ransomware also includes what may be the skeleton of an attempted 'worm' feature by creating duplicates of its executable on any network-shared folders. However, since the SAD Ransomware isn't a complete worm and can't install itself without intervention from another party, other users will need to run this file manually to infect their PCs.

Victims of any attacks should try recovering their files through secure backups, if possible, or contact security researchers experienced with threats of this category for insight into its cryptography methods (and the chances of decoding them). Paying a Bitcoin ransom has no guarantee of helping you unlock your files, and that format of currency includes no legal protections that would let the 'customer' trigger a refund for fraud. Malware experts also recommend disabling network access to other PCs until after your anti-malware products have deleted the SAD Ransomware, including any additional copies it may generate.

The SAD Ransomware's payload appears to be either incomplete or in a state of flux, indicating that its threat actors may try developing it further than its present state. However, the Trojan is already showing more than sufficiently viable attacks against not just one user's files, but the data of an entire local network, such as those managed by private businesses or governments.

SAD Ransomware

Threat Metric

The Trojan that's Happy to Make Your Files SAD

Getting the Sadness out of Your PC

Related Posts

Leave a Reply