So far infections have only been detected on Windows systems. The malware was first reported by users in BleepingComputer’s forum and analyzed by security researchers xXToffeeXx and Fabian Woser from Emsisoft. They discovered the malware has been made available through the Tor network as “Malware-as-a-service” where anyone can pay to use the ransomware. The would-be attackers just need to set up an address where to have the ransomed Bitcoin routed. Then, the affiliate is sent to an interface of the software that allows them to customize various parameters in the malware such as the message to display, ransom amount, and time frame for the payment.
Ransom32 is distributed through spam emails containing a RAR file. Once executed, Ransom32 will unpack on the temporary files folder, and copy itself to the “%AppData%\Chrome Browser” directory. Then, the malware will create a shortcut in the startup folder to ensure it is executed on every boot. The malware will then make a connection to the Command and Control (C&C) server through Tor. Once the connection is established, the malware will display its ransom note and begin encrypting files with different file extensions. For a more detailed list of the files and directories affected, visit Mr. Wosar’s article on Ransom32.
According to Mr. Wosar, this ransomware was not the work of a novice. Despite its uncommon size of 32 MB, Ransom32 is very secure AND similar to the infamous CrypytoLocker. He explains in an interview with Softpedia that since NW.js packages with the runtime into a single executable file. That way the malware doesn’t need to rely on the system to have a certain framework installed. As of now, Ransom32 is still undecryptable.
Mr. Woser suggests there should be a secure data back-up in place in order to protect your system from ransomware. Also, make sure that the backup is stored outside of your computer. Be sure to setup the backups to save new information regularly. Not only will this protect the system from ransomware, but it is a good practice to protect your files from physical damage to your system or accidental deletion.