Zuahahhah Ransomware

Posted: July 28, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	58

First Seen:	July 28, 2017
OS(es) Affected:	Windows

The Zuahahhah Ransomware is a variant of the Crypt888 Ransomware Trojan, which may encrypt or delete your media, block the screen, or display pop-ups for extorting money. Although it's compatible with free decoding software currently, most users should try to preserve backups of their files to give themselves the best recovery options against all infections with encryption-related side effects. Your anti-malware programs can delete the Zuahahhah Ransomware without its encryption routine launching or remove the Trojan from your system after the fact.

When a Con Artist's Logo Design Takes Precedence over Speaking Skills

A majority of threat actors trying to communicate with the users they attack will use English as their default language, thereby guaranteeing a built-in degree of compatibility with many, different countries. On the other hand, these people often are, themselves, dependent on automatic translation services and other, third-hand tools for delivering their demands. Ultimately, with the Zuahahhah Ransomware and Trojans like it, a sufficient lack of attention to these details even can create problems for the intended profit margins of ransom demands.

The Zuahahhah Ransomware is a straightforward modification of a previous Trojan, the Crypt888 Ransomware (also known as the Aviso Ransomware), which also was previously spun off into the GrodexCrypt Ransomware campaign. As with the last case of the Trojan's cloning, the Zuahahhah Ransomware's main change is the pop-up content it shows to the user. After finishing its other functions, the Zuahahhah Ransomware loads an HTML window with a custom logo that claims that it's committed various attacks against your PC, such as transferring information, similarly to spyware. Malware experts rate such data-collecting attacks as being not likely as an inclusion in this variant, although the ransom note's grammatical errors make a full analysis of its assertions somewhat difficult.

However, the Zuahahhah Ransomware does display other features one might expect to find in file-ransoming Trojans persistently, particularly those with an Aviso Ransomware origin. These attacks include data encryption, which blocks different files, based on their formats or locations, and the selective deletion of backup-related content on the infected PC potentially.

Silencing a Trojan's Barely Intelligible Laughter

Attacks by the Zuahahhah Ransomware can put your local content, such as documents, at risk by encoding them with a cipher, which prevents other applications from interpreting them. However, previous releases of free decryptors for the Aviso Ransomware appear to be maintaining compatibility with this update of the Trojan. For maximizing your media's safety against similar attacks, malware experts recommend storing regularly-updated backups on USB or remote network storage, which deprives the Zuahahhah Ransomware of any bargaining pressure for its ransoms.

The last member of this family of threats, the GrodexCrypt Ransomware, dates back barely a month and doesn't seem to be created by the same threat actor designing the Zuahahhah Ransomware. With its origins so new and its infection vectors not clarified, the Zuahahhah Ransomware could compromise PCs through various means, including spam e-mails, falsely labeled torrents, and brute-force attacks against business entities. Good password management and proactive anti-malware protection can improve your defenses against these attacks and remove the Zuahahhah Ransomware from your PC preemptively.

The Zuahahhah Ransomware may not do a good job of communicating either its real or perceived risks, but, like its forebears, does use encryption as a file-blocking tool. Denying Trojans of their leverage early on can help keep your PC safe, but does require some attention to your file-storing solutions before an attack can happen.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 838.64 KB (838647 bytes)
MD5: dd1a929dccd38a2e2d1b109188c3e1bf
Detection count: 25
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: July 28, 2017