KRIPTOVOR Ransomware

Posted: April 10, 2015

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	52

First Seen:	April 10, 2015
OS(es) Affected:	Windows

The KRIPTOVOR Ransomware is a file encryptor Trojan that includes features for other attacks on a modular basis, and also may collect file data. Although the KRIPTOVOR Ransomware originates in Russia, and current samples are configured primarily for targeting victims using Cyrillic script documents, its functions also may endanger the files and machines of PC users residing elsewhere. As a reasonable precaution against file encryption attacks, malware researchers advise using routine, remote backup strategies in combination with regular anti-malware scans to delete the KRIPTOVOR Ransomware as required.

Playing out a Familiar Hostage Scenario Again

The KRIPTOVOR Ransomware (or, roughly translated, 'crypto-thief' ransomware) is another file encrypting Trojan that locks you out of reading files of popular formats while holding them hostage for a ransom fee. Unlike most, alternative types of file encryptors, such as the recent CrypVault, the KRIPTOVOR Ransomware limits its payment instructions to a single text message placed in the host folders of all encrypted files. As per usual standards for ransomware, the KRIPTOVOR Ransomware also deletes system data related to system restore points that could restore the attacked files without paying its ransom.

Files encrypted by the KRIPTOVOR Ransomware can be identified by the addition of the .JUST suffix to their names, including JPG images, Word documents, ZIP archives and Web HTML pages, among over a dozen other types. While encrypted files are effectively inaccessible until you decrypt them, there are, as usual, zero guarantees of the ransom transaction offered providing the key that's needed to restore the victim's data.

The KRIPTOVOR Ransomware also uses a module-based structure that allows the KRIPTOVOR Ransomware to add or remove new capabilities over time. Some of the earliest samples of this threat included Bitcoin-collecting functions, but malware experts now have seen the KRIPTOVOR Ransomware moving into traditional spyware territory with the KRIPTOVER.Infostealer module. The following file types are targets for being uploaded to a third-party server for theft, separately from the encryption attack:

Notepad TXT files.
Word DOC and DOCX files.
ZIP, 7Z and RAR archives.
Excel XLS and XLSX spreadsheets.

Getting over a Russian File Ransom

The KRIPTOVOR Ransomware may vary its behavior, accounting for details of the infected PC, such as associated networks that could be accessible. Malware experts also saw most versions of the KRIPTOVOR Ransomware taking extra steps to conceal their installations from basic PC security solutions, regardless of the success or failure of the other attacks. As always, updating your anti-malware suite routinely, using Safe Mode for any scans and using the most in-depth scanning functions available can improve your chances of detecting the KRIPTOVOR Ransomware immediately.

However, handling the KRIPTOVOR Ransomware also requires protecting your files from the KRIPTOVOR Ransomware. You may block conventional encryption attacks with the simple expedient of using cloud storage, USB storage devices and other, secure backup options. Likewise, you should react to any suspected theft of information from your PC with immediate changes to all affected passwords and other, login-critical data. The KRIPTOVOR Ransomware's current distribution models exploit e-mail spam, with their file attachments implemented as Trojan droppers.

KRIPTOVOR Ransomware

Threat Metric

Playing out a Familiar Hostage Scenario Again

Getting over a Russian File Ransom

Leave a Reply