Blocked2 Ransomware

Posted: August 31, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	12

First Seen:	August 31, 2017
Last Seen:	February 15, 2019
OS(es) Affected:	Windows

The Blocked2 Ransomware is part of the Xorist Ransomware's family of Trojans that use encryption to keep you from opening your files. Although the ransoming demands are targeting residents of Russia and adjacent countries, the Blocked2 Ransomware can damage the contents of your PC regardless of any language settings. Anti-malware software can remove the Blocked2 Ransomware without letting it attack your data, and both external backups and freeware decryptors can help victims with data recovery.

Watching a RaaS Trojan Construction in Full Swing

Threat actors without any real programming skills, but money to spend, sometimes opt for using Trojans on a rental basis, resulting in a spectrum of threatening applications with minor, mostly cosmetic differences from each other. Ransomware-as-a-Service products like the Xorist Ransomware family compete in the same market as 'free' equivalents, like Hidden Tear, by offering more sophisticated payloads for the price. Malware analysts are adding one more member to this group for late August, the Russian Blocked2 Ransomware.

The Blocked2 Ransomware may block files on the infected PC using one of several enciphering methods, such as TEA and XOR. Its current list of targeted media to block includes DOC, DOCX, GIF, JPG, MDB, PPTX, RTF, SQL, TXT, WAV, and XLS, all of which are typical data formats for Windows users. It tags these files with the '.Blocked2' extension that it places at the end of their names without removing the original ones (for example, 'picture.gif' becomes 'picture.gif.Blocked2'). The payload's symptoms are similar in scope to those of other variations of Xorist Ransomware, including the AAC Ransomware and the Zixer2 Ransomware.

Malware analysts saw no screen-hijacking or blocking features coming through the Blocked2 Ransomware's payload. However, they do verify the Blocked2 Ransomware's using both text and Windows dialog box-based ransom notes with identical contents. Both messages ask the victim to contact the threat actor's email addresses for help (most likely at a premium) for unlocking their media.

Blocking a File-Blocker in Advance

The Blocked2 Ransomware is part of a small but increasing collection of file-locking Trojans that are targeting Russia and nations near it, for purposes only known to their threat actors. The characters that the Blocked2 Ransomware displays in its ransom messages are unreadable in systems without a Cyrillic alphabet support. However, even users capable of reading its extortion demands should consider alternate recovery choices, instead of paying the Blocked2 Ransomware's authors for attacking their files.

Some versions of the Xorist Ransomware are responsive to decryption through free software custom-made for counteracting that family. Peripheral and cloud-based storage options also can keep your media out of the scope of a typical file-encrypting attack, like those that the Blocked2 Ransomware uses. If they're using databases with updated definitions, your anti-malware software should delete the Blocked2 Ransomware without needing any additional help.

The Blocked2 Ransomware is a representative example of the kind of output one can expect from Trojans using pre-made, toolkit-based business models. Since the average threat actor needs to do less than ever to threaten your files, it's growing important to avoid placing all your digital eggs in a single basket (or hard drive) progressively.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

C:\Users\<username>\AppData\Local\Temp\827A.tmp

File name: 827A.tmp
Size: 550.91 KB (550912 bytes)
MD5: ee5fa4a6c9be3b2adfff4ad6d7eb0a4d
Detection count: 7
File type: Temporary File
Mime Type: unknown/tmp
Path: C:\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: January 5, 2019