Tunca Ransomware

The Tunca Ransomware is a file-locker Trojan that runs off of the Microsoft's .NET Framework. Its attacks can harm your media files by encrypting them and stopping them from opening while it displays ransoming pop-ups. The users should ignore all the directions in these messages and use appropriate anti-malware programs for removing the Tunca Ransomware before restoring their files by any other means that are available.

Victims Turning into Fellow Criminals

A file-locking Trojan whose development is far from being in a polished state is trying to turn its extortion solicitations into another means of distributing itself. The Tunca Ransomware is one of the many file-locker Trojans that use the developer-friendly .NET Framework platform, similar to the Hidden Tear clone of the ABANTES Ransomware and the more well-developed H34rtBl33d Ransomware. Despite this humble starting point, malware analysts find unique characteristics in the Tunca Ransomware, as well – mostly, in its ransom note.

The evidence of the Tunca Ransomware's developmental status is self-evident throughout its payload, which throws unhandled exception errors while it runs. However, the Tunca Ransomware is sufficiently functional that it's capable of locking files by encrypting them, just like the more feature-complete the Hidden Tear, the Scarab Ransomware, or the (all of which are prominent families of file-locking Trojans). The 'tunca' extension it also adds is one that malware analysts fail to see in other Trojans, and has no clear meaning, although it may be etymologically Turkish.

The less common portion of the Tunca Ransomware's payload is its pop-up message, which delivers the majority of the ransoming instructions. It formats most of the details for English-speaking, European victims, such as by expressing currency amounts in Euros appropriately. It also includes a supposedly 'free' decryption option that tells the victim to distribute the Tunca Ransomware to ten other victims via the Grabify link-tracking service, which is an unorthodox choice for a file-locker Trojan's campaign.

Declining a Disadvantageous Recruitment Offer

While malware analysts never would recommend fulfilling the demands of an extortionist threat actor, spreading file-locker Trojan infections is a particularly egregious example of abetting cyber-crime with questionable results. It's also entirely frivolous, since, in its current state, any files that the Tunca Ransomware does encrypt successfully should be decryptable by experienced AV researchers. Users should prepare backups for nullifying harmful encryption attacks, but, if they lack that solution, can contact members of the cyber-security community with seasoned credentials regarding file-locker Trojans.

These early samples of the Tunca Ransomware use names that pretend that they're parts of the Windows OS. However, most security products are detecting them and should stop the Trojan's attacks before the file-locking behavior ever begins. In most infection scenarios, an up-to-date anti-malware program should remove the Tunca Ransomware with a generic or heuristic detection.

Criminals being creative with how their Trojans get around can cause what-should-be a modest Trojan's campaign to evolve into a deadlier one. While Windows users shouldn't need informing that helping a Trojan find its victims won't help their grievances, the Tunca Ransomware's authors are confident in betting on their ignorance uncomfortably.