Serpent Ransomware

Posted: November 8, 2016

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	8

First Seen:	November 8, 2016
OS(es) Affected:	Windows

The Serpent Ransomware is an update of the PayDOS Ransomware that includes additional features related to its ransom transaction and warning message. The Trojan continues misrepresenting the act of renaming file extensions as being equivalent to encrypting them and is vulnerable by the same solutions cited in the PayDOS Ransomware article. Removing the Serpent Ransomware with anti-malware software, rather than personally, can help compensate for the possible presence of other threats or security issues that could have helped its installation.

The Second Bite from a Snake with Less Venom than Bluster

As much as threat authors value the ability to inflict real, lasting damage on a PC, not every programmer has the talent to create rootkits and other, high-level threats. These threat actors, sometimes referred to by the unflattering name of 'script kiddies,' may use social engineering techniques to create an appearance of danger rather than the fact of it. The PayDOS Ransomware including the new member of the Serpent Ransomware is one striking example currently.

Both the PayDOS Ransomware and the Serpent Ransomware use batch file-based scripts to send instructions to the Windows Command Prompt. The Trojans rename the second letter of the extension of all targeted, local files, preventing the content from opening until you rename it back to a recognizable format. Then, the Serpent Ransomware and its fellow Trojan use the CMD window for displaying a ransom message asking for payment for restoring your 'encrypted' data.

Malware experts found only minor differences between the Serpent Ransomware and the PayDOS Ransomware, including:

Unlike its ancestor, the Serpent Ransomware includes a field for contact information in its extortion instructions. However, the provided e-mail address is fake.
The Serpent Ransomware also uses the Windows text-to-speech feature for generating an impromptu audio warning The sound clip launches through a fake Windows update file (its actual format is Visual Basic) that the Serpent Ransomware places on your PC.

Examining a Surprisingly Mild Snakebite Problem

The Serpent Ransomware is no more capable than the PayDOS Ransomware of delivering a real enciphering attack against your content. Renaming each file back to its original format should restore all data to full functionality. PC owners interested in expediting the process also can use the Serpent Ransomware's built-in, fake decryption feature to do so with the key 'RSA1014DJW2048' automatically, which differs from the original Trojan's equivalent pass-code. Paying the ransom is wholly unnecessary, even for PC users without backups.

Despite the minor danger that the Serpent Ransomware represents to your PC, its existence does show that a threat actor is continuing to improve its capabilities, and may some day upgrade it into being a significant threat. Until then, using automated anti-malware software to remove the Serpent Ransomware can help account for security holes that could be responsibility for its distribution and presence on your computer.

Always take a moment to consider all the ramifications before paying a con artist's ransom demand. The chances are high that your problem, much like the Serpent Ransomware, is less threatening than it wants you to think it is.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

software.exe

File name: software.exe
Size: 730.11 KB (730112 bytes)
MD5: d2c1d7f0003cfc2d3fc7696da1bf0311
Detection count: 97
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: February 14, 2017