Unlckr Ransomware

The Unlckr Ransomware is an update of the Unlock92 Ransomware that uses a new filename-changing configuration and a different ransoming message. This Trojan may block different file formats, such as DOC, and ask you to pay money for unlocking them. Users can back up their files or use free decryption as free substitutes for the ransom, or prevent the attack by removing the Unlckr Ransomware with an anti-malware program automatically.

Little Updates for Small Trojan Families

Since its last movements in the wild, the Unlock92 Ransomware has gone through several changes, including differences in how it tracks the victim's encryption status and collects ransoms. Its threat actors are maintaining their emphasis on targeting Russia and satellites of that nation, putting citizens once excluded from similar data-ransoming campaigns at high risk. The last update to the project malware analysts can confirm is the Unlckr Ransomware, whose development goes back to March.

The Unlckr Ransomware still uses the file-encrypting functionality of the old versions of its software and can lock content including PowerPoint slideshows, BMP images, Word documents, and other media. Although previous Trojans of the same family sometimes overwrote filenames completely, the Unlckr Ransomware uses a more conventional identifier: adding '.cr020801' extensions at the end. Victims also should note that malware analysts found that a new file is storing the essential decryption data: 'your_key.rsa,' instead of the past 'yourkey.ttp.'

The Unlckr Ransomware's threat actors are professional relatively, by the standards of file hostage-taking on artists, and provide both an e-mail account and a backup TOR site for pursuing any ransom negotiations. All of the text content is in Cyrillic.

Keeping Mother Russia from Weeping over Lost Files

Paying a con artist's ransom is a risky way to retrieve your files and should be left as a final resort or ignored, if possible. While the Unlckr Ransomware's family uses RSA-based encryption that isn't highly open to quick decryption efforts, malware analysts do recommend that victims try using free decryption software to unlock copies of any encrypted content. For those who find no appeal in such gambles, non-localized backups, consistently, provide an answer to threatening, file-encoding attacks like an Unlckr Ransomware infection.

The Unlckr Ransomware campaign uses e-mail attachments for compromising target PC currently. You may receive fake or corrupted documents crafted to look like political news, but, once opened, trigger drive-by-download attacks for installing this threat. Because removing the Unlckr Ransomware afterward doesn't stop or reverse the encryption that locks your files, you should defend your computer beforehand by scanning any new downloads or employing automatic anti-malware protection.

Once, Russia was something of a haven for residents benefiting from the general rule that threat actors could target other nations without endangering themselves. However, 2017 is a new year, and Trojan attacks like the Unlckr Ransomware are renewing evidence that different assumptions govern the threat sector regularly.

Technical Details