AAC Ransomware

Posted: August 25, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	17

First Seen:	August 25, 2017
Last Seen:	February 11, 2019
OS(es) Affected:	Windows

The AAC Ransomware is part of the Xorist Ransomware family, a group of Trojans that block your files by encrypting them. Other symptoms victims may anticipate include changes to the extensions of any locked content and the presence of messages asking you to contact the AAC Ransomware's threat actors for assistance. For all threats of this nature, malware experts advise recovering with a backup or free decryption program after disinfecting your PC. Most anti-malware products should remove the AAC Ransomware by default.

Another Generation of File Extortion

The Xorist Ransomware is growing by one in late August, using a slightly customized payload to deliver otherwise conventional, data-locking attacks. Since this family uses a builder application that's open to configuring by any interested threat actors virtually, the distribution model for this new threat isn't yet verifiable. The Trojan under analysis, the AAC Ransomware, still profits through blocking local content and forcing the victim to pay for his data's retrieval primarily.

The AAC Ransomware may attack different formats of media, such as audio, documents, pictures, archives and general databases. While it, like most versions of the Xorist Ransomware, shows no symptoms while it scans your PC, any files it designates for blocking are encrypted and modified with the insertion of '.aac' extensions in their names. It also creates a custom string that's unique to each instance of its installation (for ransoming transactions as per the below details).

Text files also placed on the desktop or any folders with encoded media will display the AAC Ransomware's threat actors' ransoming instructions: contacting the provided email address with your ID for further information. No other details are available concerning the bargaining process; however, malware experts find that almost all negotiations of this type use currencies with little to no refund protection.

Inspecting a Mass-Produced Trojan Just out of the Factory

Although the AAC Ransomware uses fluent English for its text messages, this choice appears to be made for compatibility with a broad cross-section of potential victims solely. Infection statistics, so far, are showing the AAC Ransomware being delivered most often to German-based PC users. It may be using fake downloadable content, such as torrents or disguised website links, to encourage an intentional launch of its installer. Other threat actors prefer using email attachments for compromising entities that operate in the business sector particularly.

The AAC Ransomware's family has been open to decryption through free alternatives offered by reputable cyber security organizations previously. Using such software or, preferably, an unaffected backup can restore your files without the risk of paying the AAC Ransomware's author. Scheduling backups saved to a remote device you leave unattached from your computer when it's not in use is the most direct way to prevent threats from compromising your data. Additionally, any PC with up-to-date anti-malware protection should be able to block any potential file-locking attacks by removing the AAC Ransomware immediately.

Trojan-building kits like the Xorist Ransomware have a lot to offer to threat actors who crave money more than they have any interest in learning to program software of their own. The AAC Ransomware may be derivative, but its presence on the Web doubles as a showing of how these pseudo-freeware business models for Trojan development are paying off for con artists.

AAC Ransomware

Threat Metric

Another Generation of File Extortion

Inspecting a Mass-Produced Trojan Just out of the Factory

Related Posts

Leave a Reply