DNRansomware

Posted: January 23, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	16

First Seen:	January 23, 2017
Last Seen:	April 24, 2020
OS(es) Affected:	Windows

The DNRansomware or DoNotOpen Ransomware is a Trojan that enciphers your files with an AES algorithm so that you can't open them. Since the DNRansomware demands a ransom for what is a non-working decryptor currently, malware experts recommend using other recovery options such as restoring from your latest backup. In ideal circumstances, your anti-malware protection should catch and delete the DNRansomware before it can begin locking your files.

Updating Your Browser into Trouble

Fraudulent updates are favorite infection vectors for many threat campaigns, by capitalizing on the trustworthiness of a known brand and also playing off of a victim's fear of harboring software vulnerabilities. The DNRansomware is one of the newest Trojans to use such a disguise, targeting Google's popular Chrome browser. However, once the victim installs it, they receive attacks that encrypt and lock their files instead of a security update to their Web browser.

Although the DNRansomware (and a closely-related, cloned threat, the 'Jhon Woddy' Ransomware) has some non-negligible issues with its payload, its most prime attacks are fully functional. The Trojan encrypts files on the infected PC that meet its directory and format requirements, locking data such as Word documents, PDFs, AVI movies or JPG pictures. It also may append either the '.fucked' or '.killedxxx' extensions to their names.

Like the 'M4N1F3STO Virus' Lockscreen, a Trojan it shares much of its code with, the DNRansomware also blocks the user's desktop access with its ransom message. The Trojan asks for a ransom to decrypt your files, with its payment demands ranging from 0.1 Bitcoin to 0.5 Bitcoin (between 92 and 461 USD). Victims should keep in mind that malware experts did confirm that the DNRansomware does not include a working decryption feature, which makes paying this fee entirely worthless for recovering any encrypted content.

What to Do After Opening What Should Leave Closed

The DNRansomware's alias of the 'Do Not Open Ransomware' is as apt a title as it is for most file-encrypting Trojans due to the lack of viable recovery options after the Trojan locks your files. Even though current samples of the DNRansomware lack decryption functionalities, malware experts have found its hard-coded decryption keys useful for terminating its screen-locking pop-up. Input either the '83KYG9NW-3K39V-2T3HJ-93F3Q-GT' or the 'M3VZ>5BwGGVH' code, if necessary, to regain access to other software and your desktop.

With no decryption solutions on offer for the DNRansomware, backing up your data before an infection is the only surefire way of reversing all encryption damages this threat inflicts. Although malware experts recommend against relying on local backups that the DNRansomware may delete automatically, backups saved elsewhere, such as on an external server or device, can give victims easy (and no-ransom) ways of recovering fully from an attack. Many anti-malware applications also may detect and delete the DNRansomware accurately before it can install itself.

In sharp contrast to what the DNRansomware would like you to believe, assuming that a Trojan is dealing with you honestly may be a poor idea. Before you pay, stop and consider what incentive a con artist might have to honor his word, particularly when any payments occur through non-revocable methods like Bitcoin.

DNRansomware

Threat Metric

Updating Your Browser into Trouble

What to Do After Opening What Should Leave Closed

Leave a Reply