SkyName Ransomware

Posted: January 10, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	63

First Seen:	January 10, 2017
Last Seen:	June 27, 2023
OS(es) Affected:	Windows

The SkyName Ransomware is a variant of Hidden Tear, a formerly open-source 'example' of file-encrypting threat. Although the SkyName Ransomware doesn't include an encryption feature currently, the Trojan still is in development and most likely will be seeing such additions before its threat actors deploy it. Use common-sense security protocols such as backing up your files and scanning new ones to delete the SkyName Ransomware before it can position itself to lock your content.

A Fresh Name for Hidden Tear in the Czech Republic

New releases of Hidden Tear are relatively unremarkable, except for verifying that threat actors are continuing to use free or cheaply-bought resources for threat out of a preference for efficient time management. The SkyName Ransomware is a January-dated threat that most likely will develop into launching the same kinds of attacks as the Koolova Ransomware and the RIP Ransomware. Unlike them, however, the SkyName Ransomware offers clues as to the threat actor's origin inadvertently, which may be the very same region as his intended victims.

The SkyName Ransomware is one of the only variants of Hidden Tear that doesn't fully implement its encryption function currently, meaning that victims with an infection by this prototype version will not need to restore their files. However, when working, it encrypts your media (selected according to their formats and locations) with an AES-based cipher, 'locking' them until you can decrypt them. Most versions of Hidden Tear upload the decryption keys to an external Web server, allowing con artists to sell it back to the victims in return for money.

Besides its work-in-progress state, the SkyName Ransomware is unusual for using Czech-based ransom messages and small extortion payments (under forty USD in value). Malware experts also connect the in-use e-mail address for ransom demands to extraneous campaigns involving the selling of compromised Czech book publisher e-mail databases. Altogether, these traits could be signs of the threat actor being inexperienced or uncertain of his threat deployment capabilities.

Clearing the Sky of More Trojan Clones

While the money the SkyName Ransomware's threat actor demands in return for a decryptor is small, PC users with encrypted files should consider using free resources beforehand. Malware experts also would advise keeping backups, in light of the recurring issue of Trojans without decryption solutions leveraging unbreakable encryption attacks. However, the SkyName Ransomware's campaign doesn't appear to be positioning itself for targeting business systems currently, making it a risk for casual PC users with unsafe downloading habits primarily.

File-encrypting threats with such low fees often are distributed through bundles with other, equally illicit files, such as cracked games, key generators, and other piracy-oriented applications. However, most anti-malware applications do detect different versions of Hidden Tear during their normal file scans. Deleting the SkyName Ransomware or Trojans like it before they get the chance to launch their full payload can be the only opportunity you have to keep the Trojan from blocking your files with little or no unlocking options.

Extortion is as much a full-time job as most other careers, and insufficient devotion to it can give rise to faulty output. Readers only can hope that the SkyName Ransomware's author will remain sufficiently unmotivated ever to finish this unneeded clone of Hidden Tear.

SkyName Ransomware

Threat Metric

A Fresh Name for Hidden Tear in the Czech Republic

Clearing the Sky of More Trojan Clones

Leave a Reply