SaveTheQueen Ransomware

The SaveTheQueen Ransomware is a file-locking Trojan that can encrypt your PC's digital media and hold it hostage. The SaveTheQueen Ransomware also includes supporting attacks for extorting money and data-collecting ones, possibly, for gaining access to files on related systems. Users should let their anti-malware protection handle removing the SaveTheQueen Ransomware in most circumstances and keep backups for cheap recovery options.

God Save Your Files from a Trojan

Independent file-locking Trojans have the disadvantage in numbers against their Ransomware-as-a-Service counterparts and, in previous years, spinoffs of Utku Sen's Hidden Tear software. However, smaller in quantity isn't nonexistent, as 'lone wolf' style Trojans like the Sun Ransomware, the original Mr.Dec Ransomware, the Mind Ransomware and the SaveTheQueen Ransomware show. That last, however, has extra features that are both invisible to victims and of critical importance – and danger.

Malware researchers are finding two versions of the SaveTheQueen Ransomware, although one is, likely, just an earlier, 'trial' version for testing security databases. Both branches include encryption attacks that lock files, such as documents, pictures, and other media, and append extensions from the Trojan's name onto them. One version also loads a visible CMD window, which is a usually-hidden utility for file-locking Trojans that facilitates deleting backups and other system changes.

Only one of these variants has a ransom note, which it gives out in a TXT file. However, the more threatening is the entirely-invisible routine the Trojan possesses of collecting credentials (such as passwords) from the computer. The SaveTheQueen Ransomware also may modify Chrome extensions as a part of this process. Although malware experts have no evidence of this second attack's motives, it's more than possible that criminals are leaning into it as a way of traversing networks and getting access to more files for sabotaging.

Ending a Wicked Monarchy's Reign before It Starts

The SaveTheQueen Ransomware is only a threat to Windows systems but provides many of the dangers of a more-polished, Ransomware-as-a-Service infection. The SaveTheQueen Ransomware can deny users their files indefinitely, and malware experts have yet to determine whether or not decryption by free services is a practical answer. It also provides remote attackers with access to credentials and their accounts, either for selling the data or spreading the SaveTheQueen Ransomware to other machines.

Besides limiting any Intranet contact between compromised and secure systems, users also can protect themselves from a possible infection attempt preemptively. Maintaining proper network security practices, installing security patches promptly, avoiding threatening download sources like torrents, and being careful around potential phishing lures (like Word documents with embedded macros) are all relevant equally. Even the 'test' build of the SaveTheQueen Ransomware can damage files permanently.

Users always should have another backup on a secondary device for recovering from encryption attacks like the SaveTheQueen Ransomware's payload. Otherwise, having appropriate anti-malware products for deleting the SaveTheQueen Ransomware as soon as possible remains the best protection for one's files.

The SaveTheQueen Ransomware is storing an extra weapon under its crown while distracting victims with the more-obvious encryption. That sleight of hand can't be good news for anyone except ransom-hungry criminals.