ChineseRarypt Ransomware

The ChineseRarypt Ransomware is a Trojan that locks files and takes your media hostage by placing it inside of a series of password-protected archives. It monetizes its attacks with ransom notes that copy the content of other, unrelated Trojans that encrypt files individually. Users can keep secure backups as a precaution against infections or remove the ChineseRarypt Ransomware at any point with updated anti-malware tools.

A Copy of a Copy Remains a Problem

File-locking Trojans, sometimes, will copy the looks or symptoms of another one – usually, for making themselves seem better-programmed or more secure than is the reality. The ChineseRarypt Ransomware is taking that several steps farther than is normal by copying a copy of a copy of a copy of a Trojan family. Unfortunately, its attacks, while not in line with its disguise, are just as much of a problem for users without backups.

The ChineseRarypt Ransomware's Windows installer is a file of under ten kilobytes. This CMD batch file is the Command Prompt equivalent of a BAT and is avoiding most of the standard heuristics for detecting file-locker Trojans. Through a series of script commands, the Trojan moves all the user's media files into archives, with one RAR archive per format (such as JPG pictures or DOC documents). It password protects this enclosing archive and delivers what may be, for many readers, a familiar-looking ransom note after that.

The ChineseRarypt Ransomware's ransom message comes in Chinese and English and is a copy of the Maoloa Ransomware's similar instructions. The resemblance between these threats and the attacks of the GlobeImposter Ransomware, and, in turn, the Globe Ransomware family, makes a case of mistaken identity likely and highly forgivable for any victims. Usually, the greatest danger of mistaking a file-locker Trojan's identity is running the wrong unlocker application, although the ChineseRarypt Ransomware's archive-based attack dispenses with that issue.

Keeping Your Files Out of the Wrong Archival Process

Besides the self-evident detail of its targeting Chinese victims, malware researchers can confirm another part of the ChineseRarypt Ransomware's campaign involving how it's infecting users' PCs. MD5 information associated with some the ChineseRarypt Ransomware attacks has connections to a macro-enabled spreadsheet about 'panorama sunroof' features in an unspecified car manufacturer's products. Macros are a routine delivery mechanism for Trojans of many types, including file-locking Trojans of all varieties.

Users can disable macros and update their copies of Excel for extra safety against the ChineseRarypt Ransomware's campaign. They should express further care against interactions with unexpected e-mail attachments or links that fit the theme of a traditional phishing attack. Even though the ChineseRarypt Ransomware is extorting Chinese-speaking victims, the RAR-archiving routine could harm the files of any Windows computer.

Since the ChineseRarypt Ransomware's batch file is evading many security services, malware experts emphasize updating your anti-malware solution's threat database for accuracy. Removing the ChineseRarypt Ransomware by oneself remains non-recommendable for users without backgrounds in PC security.

The ChineseRarypt Ransomware may be a pretender, but the media accessibility issue it causes is quite real. You can stop it before it happens or depend on your backups, but doing neither is as good as throwing your work in the garbage.