Spora Ransomware

The Spora Ransomware is a Trojan that encrypts your files and redirects you to a ransom-processing portal to buy them back. Although its Web infrastructure is notably in-depth, the Spora Ransomware uses the same e-mail distribution exploits seen by past file-encrypting Trojans in other campaigns. Since this threat is unlikely ever to be vulnerable to third-party decryption, keep backups to eliminate any damages and use anti-malware products for removing the Spora Ransomware safely.

The Most Well-Designed Spore You Ever Saw

Ironically, it's in many threat authors' best interests to make the final phases of their attacks as pleasant and streamlined as possible for their victims. Victims with reader-friendly instructions on transferring ransom money to 'fix' their PCs may be more inclined to do so than those who merely receive an e-mail address and no other information. For both its actual attacks and its website services, the Spora Ransomware (or 'Spore' Ransomware, when translated from Russian) is a particularly well-done example of Trojan design.

In keeping with the cliché of its industry, the Spora Ransomware disguises its installers as invoice documents by using secondary extensions, with its threat actors targeting new victims with appropriately-crafted spam e-mails. Opening the fake document (actually an HTA file) launches the Spora Ransomware, which distracts the victim by loading a corrupt Word document. It then proceeds with encrypting your local data, including anything accessible over local networks.

The encryption routine, itself, is notably intricate and occurs without any need for a network connection to a C&C server. Instead, the Spora Ransomware creates a KEY file that the victim uses later in the ransom payment process. 'Later' involves synchronizing the victim-specific KEY to a TOR gateway website that shows off the Spora Ransomware's Web panel, including features like:

• A live chat window lets victims speak with the threat actors for negotiation or help.
• A range of ransom-paying options, including ones for restoring individual files or, in theory, giving yourself immunity to future the Spora Ransomware attacks.
• A transaction database and various time-tracking elements.

Most unusually, the Spora Ransomware also embeds additional information in its '.KEY' file regarding the attack. This extra data lets the threat actors adjust the prices on display at their website dynamically, according to the financial circumstances of the victim (such as charging more for a business employee, and less for a home PC user).

Waving a Cloud of Spores out of Your Files

The Spora Ransomware encrypts only a small list of widely-used formats, including ones associated with the Microsoft Office, CD content, backups, pictures and ZIP archives. Unlike most of its competition, malware experts see no evidence of the Spora Ransomware including a filename-modifying feature, such as appending a new extension onto what it encrypts. The combination of AES and RSA encryption that the Spora Ransomware uses is one that malware experts rate as being unbreakable currently. The threat actors do have a history of honoring their ransom agreements with real decryption assistance, although you always should attempt alternatives other than paying extortionists.

Current samples of the Spora Ransomware attacks all derive from Russian targets. However, the Trojan does track geographical data that could assist its campaign with expanding to other nations. As with any threat whose payload inflicts damage on your local content, stopping the installation routine should take priority. Display all extensions by default, when possible, and use anti-malware products to verify the safety of any attachments before you open them.

The Spora Ransomware is clearly the work of a team with years of experience in UI design, social engineering, encryption methodology, and many of the other nuances of running a threat campaign. While it may be 'prettier' than the competition, it's also just as threatening as them, and, fortunately, containable by the same security protocols in use against old file-encrypting threats.

Technical Details