ZekwaCrypt Ransomware

Posted: January 27, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	94

First Seen:	January 27, 2017
Last Seen:	May 5, 2023
OS(es) Affected:	Windows

The ZekwaCrypt Ransomware is a Trojan that encrypts your files so that it can force you into paying ransoms for unlocking them. Such attacks may deliver inconclusive results to those who pay the demanded money and are restricted most easily by your keeping remote backups for an easy recovery. Malware experts also recommend scanning infection vectors like e-mail attachments so that your anti-malware protection can delete the ZekwaCrypt Ransomware immediately.

Why Almost Nothing on Your PC is Safe from a Trojan

Con artists are forced to make choices in how they implement data-encrypting attacks against business networks, personal-use computers and even 'smart' devices like mobile phones. Although many of them choose to prioritize a fast payload over a thorough one, not every Trojan limits its potential damages this way. One 2016-era threat, the ZekwaCrypt Ransomware, includes wide ranges of formats in its attacks, as well as covering almost all folders on the victimized PC.

The ZekwaCrypt Ransomware (also referenced as Ransom: Win32/the ZekwaCrypt.A or the ZekwaCrypt 'Virus') installs itself along with various Registry changes that let it launch by default initially. The early phase of the application's launch shows no symptoms while the ZekwaCrypt Ransomware encrypts files on your computer to lock them. In total, the Trojan enciphers and blocks just under five hundred formats, including ones specific to business industry software like CAD, as well as many casual-use formats such as JPG. Every encrypted file also has its name changed with an additional '.zekwakc' extension.

Although many Trojans target specific folders, such as Users or Downloads, the ZekwaCrypt Ransomware targets almost all directories with a minimum of discrimination. Malware experts find the ZekwaCrypt Ransomware only excluding locations specific to the OS, such as Windows, or ones associated with torrent downloads (most likely due to the large sizes of such content that could extend the attack's duration to an excessive degree).

Also unlike similar threats, the ZekwaCrypt Ransomware can complete its payload without needing any access to the Internet.

The Problems with Payments for Locked-Down Data

The ZekwaCrypt Ransomware creates simple text messages for instructing any victims to decrypt their data by making ransom payments to its threat actor. Due to the periodic release of free decryption applications by the anti-malware industry, making these payments can be unnecessary for decoding any files that Trojans of this classification might lock. However, decryption software sometimes is unavailable, and con artists may not provide such a solution, whether or not you pay them.

The ZekwaCrypt Ransomware deletes any files including 'backup' as part of their filenames, which limits the user's local recovery options. Malware experts recommend using backups that you store on a removable device or another server, when possible, for providing yourself with maximally safe recovery methods. As an alternative, many anti-malware products should delete the ZekwaCrypt Ransomware when it tries to compromise your PC automatically.

Threatening encryption campaigns can be very broad or very narrow in their scopes. Rather than assuming that your files will be safe because of a non-standard location or extension, the ZekwaCrypt Ransomware is a sharp assertion of the fact that digital extortion is a problem with few firm boundaries.

ZekwaCrypt Ransomware

Threat Metric

Why Almost Nothing on Your PC is Safe from a Trojan

The Problems with Payments for Locked-Down Data

Leave a Reply