DeriaLock Ransomware

The DeriaLock Ransomware is a Trojan that can lock your screen with a ransom message, block some Windows applications, and encrypt your file data. Take all necessary steps for disabling this threat's lock-screen and recovering any enciphered content as per this article's recommendations. Although this Trojan's distribution exploits are still under investigation, dedicated anti-malware software also may be able to block or remove the DeriaLock Ransomware automatically.

Instant Messaging Your Way to Extortion

It's no accident that most file-encrypting Trojans include semi-automated and non-personalized extortion strategies that process payments without the threat actor's help. Although these methods do help con artists receive the most pay for the least amount of effort, other threat actors prefer a 'personal touch' that lets them control the negotiations directly. The DeriaLock Ransomware is one of the relatively few samples malware analysts find of a file-encoding Trojan that uses Skype for its ransom-negotiating platform.

The DeriaLock Ransomware requires .NET Framework 4.5 for installing itself, which makes it compatible with most versions of Windows past Windows XP. The installation routine includes generating an MD5 hash (based on the local MachineName) that the Trojan uses as part of the ransom process. The DeriaLock Ransomware also updates itself automatically and conceals the newly-downloaded file in a sub-directory of the 'users' folder.

Different versions of the DeriaLock Ransomware may or may not include a file-encrypting behavior that locks your files with a cipher. PC users who do have cipher-locked data can identify it by the appended '.deria' extension in the filename.

Whether or not the DeriaLock Ransomware encrypts anything, malware experts confirm its locking the desktop by displaying a full-screen window with its ransoming instructions. Besides taking the unusual option of referring all victims to the threat actor's Skype account, the DeriaLock Ransomware includes multi-language support for German and English, with Spanish advertised but not yet implemented. Since the ransom message locks the screen, the victim must use another device to launch Skype and submit to the thirty USD extortion process explicitly.

The Simple Key to a Black Screen of Threats

With its containing spelling and grammar issues in its ransoming messages, the DeriaLock Ransomware is not likely of being a product of a native English or German speaker. However, lack of linguistic fluency doesn't lower the security risks the DeriaLock Ransomware may cause. Malware experts see versions of the DeriaLock Ransomware closing the memory processes associated with a variety of applications automatically, including some security utilities and social networking applications (including Skype).

The DeriaLock Ransomware's author also includes defenses against forcibly closing the screen-locking window via keyboard shortcuts. Accordingly, victims will need to reboot their computers with an external drive or into Safe Mode to disable the DeriaLock Ransomware's auto-start routine. Doing so will let them access any applications and their desktops, although any encrypted content still will be unreadable. Although malware experts recommend removing the DeriaLock Ransomware with anti-malware products capable of detecting it during their system scans, third-party recovery utilities also can help decrypt any remaining, locked files.

The DeriaLock Ransomware includes a final, unusual feature: the ability to unlock all infected systems at once, based on data it receives from its network communications. However, only the Trojan's threat actor can provide the needed server data, which makes relying on the mercy of cyber crooks a sub-optimal security strategy for anyone.

Technical Details