Usam Ransomware

The Usam Ransomware is a file-locking Trojan from the STOP Ransomware family. Although the blocking of digital media is its priority feature, the Trojan also includes other security issues, such as collecting credentials with the help of AZORult. Users should maintain their backup options diligently and have anti-malware services active for deleting the Usam Ransomware.

Never Losing an Opportunity to STOP Someone Else's Files

Nearer to the emergence of data encryption as a weaponized way of making money, Hidden Tear held the crown for most-abused Trojan of this kind. File-locking Trojan businesses aren't static, though, and the STOP Ransomware family is one of the most wide-ranging and diverse entities in the field currently. This Ransomware-as-a-Service is responsible for countless file-locking Trojans, with the Usam Ransomware as an extremely-recent case in point.

The Usam Ransomware targets Windows environments and uses the fake 'TMP' (or 'temporary file') extension for hiding its identity from users' eyes. Although one may safely presume that the Trojan uses the latest-available build for the STOP Ransomware family, malware analysts can see few differences in features between the Usam Ransomware and its ancestors. File-locking attacks (using a C&C key or a built-in one) are its hallmark, just like with its kin, the Nbes Ransomware, the Reco Ransomware, the Rote Ransomware, the Sqpc Ransomware, et al.

Besides the encryption, which holds hostage content like documents or images, the Usam Ransomware also can delete local backups that use the Shadow Volume Copies, such as the Restore Points. It accomplishes this with built-in CMD commands, which decreases its dependency on third-party software. However, some infections from this family include at least one additional program: AZORult, a password collector.

Taking Trojan Finances Down a Peg

Users should always guard against possible file-locking Trojan installers, which can result in severe data loss. Some of the pathways that malware experts see Trojans of the Usam Ransomware's family taking include:

• Torrents with illicit software and media themes may install the Usam Ransomware directly.
• Attackers may break into poorly-secured servers by using software vulnerabilities or brute-forcing logins.
• E-mail attachments may deliver the Usam Ransomware through document-embedded macros and similar attacks.
• Web surfers also are at risk from the RIG Exploit Kit and other EKs if they're using JavaScript, Java, or Flash without restrictions, especially.

Excellent browser security standards, password management, patching schedules, and download curation will take most of these vulnerabilities out as possible avenues for the Usam Ransomware. Although only Windows users are at risk from the STOP Ransomware family, smaller families invade other operating systems.

Backups can give any victim a 'free' recovery, and anti-malware products with the standard compatibility and database caveats can delete the Usam Ransomware without issues.

The STOP Ransomware isn't going to 'stop' while the money is flowing. Anyone who runs into the Usam Ransomware would do well to remember that and keep any ransom cash to themselves.