Ecovector Ransomware

The Ecovector Ransomware is a new file encryption Trojan possibly based on the same foundation of code as old threats, particularly those from the Rakhni family. Like them, the Ecovector Ransomware uses encryption as a means of taking your data hostage, with e-mail messages serving as the way of negotiating a ransom fee. While some individuals have chosen to pay such ransoms, malware experts discourage it and recommend removing the Ecovector Ransomware with an anti-malware tool, followed by restoring the locked content from an uninfected backup.

A Highway to Encrypted Hard Drives

Although the technical details of encrypting data with or without its owner's consent is relatively straightforward, the victim's actions also are a critical element in how these kinds of threat campaigns make money. Con artists may take drastic measures to force their victim's hand, such as deleting files every hour, or use pseudo-subtle methods, as malware experts see through the Ecovector Ransomware. This Trojan delivers subtly misleading information in its ransom notes, encouraging you to pay for help retrieving your content.

The Ecovector Ransomware selects files for attacking based on their formats, such as the popularly-targeted DOC, PPT or XLS. The content then is encrypted through an AES-based algorithm with no warning symptoms and finally given a new extension consisting of a custom ID, an e-mail address and the XTBL tag. Much like any file placed into a compressed archive, encrypted data will fail to open, and requires a corresponding decryption process to be restored to normal.

In this first phase of the Ecovector Ransomware's payload, malware experts find no significant symptoms; however, its final actions include depositing visible files on your PC. These drops consist of both a text-based ransom message and a desktop wallpaper. Besides displaying some stock art of a highway vista, the latter also recommends contacting a 'technical support' entity through its e-mail address for help, using a tactic very similar to that of the Mahasaraswati Ransomware.

A Fast Exit from a Digital Hostage Situation

Although its authors have put a minimal amount of effort into disguising their identities, the Ecovector Ransomware's output does correspond with the traditional payloads of threatening file encryptors. Communicating with its administrators, even for the purpose of saving your data, always is undertaken at your personal risk, and malware experts particularly don't recommend paying any suggested fees for your file restoration. Instead, use the decryptors provided by reputable security organizations free of charge, or keep copies of your content in locations unlikely of being attacked, such as a cloud server.

Following an Ecovector Ransomware attack, you should reboot your computer. Restart the system in Safe Mode as per the specifications for your operating system, and scan your PC with the anti-malware products of your preferred brand. Even though the Ecovector Ransomware has no observable capabilities for handling its installation to new locations, threats responsible for delivering the Ecovector Ransomware still may load new threats. Since decryption is a separate technical procedure from deleting threatening software, other data recovery protocols may be necessary after removing the Ecovector Ransomware.

Many encryption-based Trojans may use e-mail attachments or embedded links for installing themselves. A lesser number of similar campaigns also may use exploit kits or installers bundled in illicit software downloads. In all cases examined by malware experts, such an attack never could succeed without some level of indiscretion on the victim's part, making the user the biggest security flaw of all.

Technical Details