Tear Dr0p Ransomware

The Tear Dr0p Ransomware is a file-locking Trojan that holds media such as pictures and documents hostage until you agree to its 'ransom' of playing a bundled game. PC users may achieve a high score for unlocking their media, use a free decryptor that's specific to the Hidden Tear family, or recover from a backup. Your anti-malware programs should remove the Tear Dr0p Ransomware by default and prevent its data-enciphering attacks from launching.

The Stakes of Gaming are Higher than Ever

Although collecting money is the usual reason for threat actors to create file-locker Trojans, the easiness of exploiting 'freeware' sources of a corrupted code, like Hidden Tear, also encourages relatively frivolous uses. One extreme minority of motivators includes forcing the victim to play a game for the threat actor's amusement, as per the old Rensenware Ransomware or the new the Tear Dr0p Ransomware. Victims can choose to play this Hidden Tear revamp's game and get a high score to recover their files, instead of the usual ransom of paying money.

Like most versions of Hidden Tear, the Tear Dr0p Ransomware is under one megabyte, enabling its rapid download and installation via exploits such as EK attacks or corrupted macro documents. When the user runs it in a Windows environment, the Tear Dr0p Ransomware blocks file formats that include Word or Adobe documents, JPG images, and others, with a non-symptomatic encryption sequence that uses an AES-256 cipher. It creates a '.teardr0p' extension, which the included decryption tool uses for identifying what content requires unlocking.

However, before they gain access to this decryptor, the Tear Dr0p Ransomware creates a pop-up UI demanding that they play a simple, button-passed pattern recognition game and achieve a high score. Malware experts have noted that the game's internal logic for a solution is publicly available, and also that free decryption tools should be helpful for breaking the Trojan's relatively non-secure encryption routine. No additional attack features are present, although the users will not be able to open their encrypted files until employing these, or other, recovery methods.

Don't Play the Games that Trojans Want

While there's relatively little harm in playing the Tear Dr0p Ransomware's code game, Trojans with similar attacks often use games for distracting the user from other issues, as malware experts previously found with the Kryptonite Ransomware campaign. In general, any victims of file-locking Trojan infections should avoid following the instructions of these threats, as long as other recovery are available. Having a securely-stored backup also is reliably useful for devaluing any potential data loss from the Tear Dr0p Ransomware's attacks.

The Tear Dr0p Ransomware is only available in a single, early version, but does have complete functionality without any glitches, as far as malware experts are determining. Since how its threat actor is distributing it is a factor that's still under investigation, users should depend on updated anti-malware solutions for blocking its installation or attacks. Most anti-malware products can delete the Tear Dr0p Ransomware, and other Hidden Tear variants easily, to protect your files, if not reverse any already-inflicted encryption necessarily.

Although its payload more whimsical than those of most file-locking Trojans, the Tear Dr0p Ransomware is equally adept at putting your files in harm's way. Instead of playing what Trojans want on demand, PC users should do their best to avoid attacks by well-known vectors and use standard security procedures for keeping the damages minimal.