Shark Ransomware

The Shark Ransomware is a Trojan that encrypts various files on your PC (determinable by a customized configuration menu) and displays a ransom message requesting both an e-mail address and a Bitcoin payment. While paying may or may not provide a decryption service, malware experts always recommend keeping backups that can prevent the Shark Ransomware from doing any irrecoverable file damage. You can identify this threat by the symptoms in this article and use appropriate anti-malware solutions for removing the Shark Ransomware safely.

The Surprise Waiting Beneath Cyber-Sea

Con artists interested in using software to harm others always are more numerous than the skills required to create this harmful software from scratch. However, a recurring characteristic of the threat industry is its capacity for delivering these tools to potentially incompetent hands, such as the rental model espoused by the Shark Ransomware. The Shark Ransomware is one of the few threatening file encryption kits malware experts have seen that require no programming knowledge at all.

Unlike most black market products, the Shark Ransomware's business is using WordPress hosting currently, rather than a TOR-based anonymous domain, to promote its free program downloads to potential distributors. Con artists can download the Shark Ransomware for free and then use a configuration file to set several values, including which files are encrypted in various locations, as well as what languages its ransom note uses and the size of the payment. The same download also includes the executable half of the Shark Ransomware that con artists distribute to the victim by whatever method they prefer.

This second executable encrypts the data on the infected PC, abiding by the settings noted in its configuration file. Malware experts also saw the Shark Ransomware adding the '.locked' extension to enciphered data, which does not appear to be configurable and, therefore, serves as one way of identifying the threat. However, this attribute is one that the Shark Ransomware does share with several other families of file encryption Trojans.

Once it encrypts and thereby blocks all targeted content, the Shark Ransomware then launches another executable component that loads a pop-up. This window displays the Shark Ransomware's ransom message and a request for an e-mail address, after which it demands a Bitcoin payment for its decryption service.

Keeping a Digital Predator from Preying on Your Computer

The Shark Ransomware is a particularly accessible Trojan that any remote attacker could use with no more knowledge than finding out the address of its downloadable installer. Although malware researchers and others within the industry are investigating possibilities in cracking weaknesses in the Shark Ransomware's encryption method, it still is a new threat and has no public decryptor available currently. Protecting your data beforehand, such as keeping a backup on a removable drive, is the defense most likely to keep the Shark Ransomware from doing irreversible damage.

The Shark Ransomware infections show symptoms that are very high in visibility. Due to its configuration possibilities, the encrypted content may vary its location or format. However, you always can identify encrypted information by searching for the '.locked' extension. Victims also may look for a database that the Shark Ransomware includes in its installation (found at %UserProfile%\AppData\Roaming\Settings\files.ini), which lists all enciphered content by name.

Use your anti-malware tools for removing the Shark Ransomware, which includes misleadingly-named components in different locations of your hard drive. As long as predators like the Shark Ransomware make themselves available to third parties easily, PC owners will need to protect themselves from all possible infection vectors, including routes as different as e-mail attachments, fake software updates and misnamed torrents.