Empty Ransomware

The Empty Ransomware is a modified release of CryptoMix, AKA the CryptMix Ransomware. This Trojan locks the files of your PC to provoke ransom payments for decoding them, although there's no guarantee of recovery. Besides using free decryption software, victims can prevent the Empty Ransomware's attacks from causing permanent damage by storing backups on another device. Professional anti-malware products also can protect your files by deleting the Empty Ransomware at an infection's outset.

Trojans Cluttering Your Files to Empty Your Cash Reserves

2017's numerous introductions of new members of the CryptMix Ransomware family are continuing apace with the recently-detected Empty Ransomware, which may be acting as either an upgrade or competition for the Exte Ransomware, the MOLE Ransomware, and similar threats. In a trend common to many, new editions of Trojan families with encryption-related payloads, the Empty Ransomware's threat actors are refusing to give any upfront information on how to recover any damaged files. However, by the time the symptoms are detectable, the Empty Ransomware has finished all of its attacks.

Depending on whether the PC has an Internet connection when the Empty Ransomware launches, the Trojan may retrieve a key from a remote attacker's server or generate a static one. In either case, the Empty Ransomware begins scanning the 'disposable' files of your PC, such as documents, pictures, and archives, and encrypting them using an AES or Rijndael cipher. It also runs this code through a second, RSA algorithm (for decoding prevention).

Although the Empty Ransomware appends a new '.EMPTY' extension onto the names of any media it's blocking, it also overwrites the rest of the names by encoding it separately. Then, it drops a Notepad file containing the threat actor's minimalist instructions: contacting one of three email addresses for decryption help, with your custom ID. Refraining from giving out up-front details on any ransoming demands could be to help encourage victims to invest themselves in the negotiations emotionally before deciding on a price they're most likely to pay.

Emptying Your PC of Reusable Trojans

Since the Empty Ransomware's infection strategies of choice aren't verifiable yet, malware experts recommend paying attention to the most-used means of Trojan infiltration for the year. These methods include spam email attachments, brute-force attacks leading into abuses of the Remote Desktop features, browser vulnerabilities abusing content like JavaScript, and fake downloads of illicit content (such as game cracks). Use safe passwords, network settings, and Web-browsing configurations to reduce the chance of your exposure to the Empty Ransomware through any of the above attacks.

Some samples of the Empty Ransomware's family show a degree of potential compatibility with free decryption programs, which can be a viable means of unblocking your media. This solution isn't always reliable, however, and malware experts recommend adhering to a regular backup routine to keep the Empty Ransomware from holding hostage the only copies of any valuable files. With limited symptoms during its first attacks, PC users should try to delete the Empty Ransomware proactively with an anti-malware program and eliminate any successful infections with similar software.

The Empty Ransomware appears to be 'empty' of any original features that the CryptMix Ransomware isn't already demonstrating on live targets mostly. It's unfortunate that even Trojans bereft of creativity are powerful if illicit, tools for attacking PC users who aren't protecting their work properly.