FrozrLock ransomware virus is being sold on the dark market
FrozrLock is a new Ransomware-as-a-Service (RaaS)[1] type of cyber infection that is currently being sold on the Dark Web for only $200. For this price, users get access to the dashboard that allows monitoring infected devices, a default ransom note, and decryption software. Developers of the ransomware created a professional service. The user-friendly interface might seem convenient and attractive to hacker-wannabes. Meanwhile, malware researchers have been analyzing FrozrLock for a while. The latest research allows making assumptions that it might be written in C# language and designed to encrypt files with AES or RSA ciphers. Talking about technical characteristics, after a successful attack, it deletes the loader automatically. However, encrypted files stay on the system, and a ransom-demanding message informs about a necessity to pay 0.5 Bitcoins in two days. There’s no doubt that some victims of the ransomware will take this risky offer. If they would be lucky, their files will be restored and malware deleted from the device automatically. Indeed, it is designed to terminate itself as soon as the ransom is paid. However, we do not recommend choosing this FrozrLock removal option and risking to lose your money. When dealing with file-encrypting viruses, we highly recommend scanning the computer with FortectIntego and cleaning cyber infection using a credible software.
FrozrLock has been spotted on April 2017, when it launched few attacks in Russia. Then malware has been spread via Contract_432732593256.js JavaScript file. However, currently, the virus license is being sold on the dark market. Developers of this malicious program are confident about this project and present it as the “great security tool that encrypts most of your files in several minutes.” If evil-minded people, who are interested in taking first steps in cyber crimes, decide to purchase it, they need to access a particular website using Tor browser and create the account. When they log in, they see ransomware control panel. But before starting playing with FrozrLock virus, they need to transfer Bitcoins. Once the payment is made, they get access to the user-friendly dashboard which allows seeing infected devices and decrypting victims’ files. Hackers have the power to use decryption software in three modes: auto, manual, and an alternate manual. Thus, crooks have the power to give victims a mercy or not. After receiving a ransom, they may not recover all your files or demand to transfer more Bitcoins in order to get back all the files. Obviously, paying the ransom is not recommended.
This RaaS package also includes a default ransom note. It’s quite unique ransom-demanding message that allows paying the ransom not only by transferring Bitcoins to the provided Bitcoin Wallet address. Victims can also use a provided QR code. Thus, crooks put paying the ransom to the next level and wanted to simplify the payment. The ransom note informs that the “MasterKey,” which is necessary for recovering files encrypted by FrozrLock costs 0.5 Bitcoins. Victims have 48 hours for transferring the money and hoping for the best. We want to remind that data recovery is only the matter of cyber criminals’ conscience. Thus, you should rely on other data recovery possibilities and use data backups. However, before even thinking about data recovery, you should remove FrozrLock from the device.
Ransomware distribution methods
As you already know, hacker-wannabes can buy the FrozrLock ransomware from the dark web. Further distribution techniques and strategies might differ. However, the biggest chances are that malware might be spread via malicious spam emails and their attachments, using exploit kits, malvertising or bogus software downloads or updates. Thus, there are numerous ways how ransomware might get inside the computer. If you want to minimize the risk of the attack,[2] you should be careful with emails and avoid opening unknown attachments, do not browse through high-risk websites, choose reliable sources for software installation, do not update software from ads and install reliable security program.
Removal of the FrozrLock virus
Victims can remove FrozrLock only with the help of professional malware removal program. Thus, you need to install a security software, update it and run a full system scan. Indeed, everything sounds simple; however, you might encounter few problems. First of all, you need to choose a perfect software for you. If you need advice, choose either FortectIntego or MalwarebytesMalwarebytes. Secondly, malware may prevent installation of the tool. Thus, you may need to reboot your device to the Safe Mode with Networking as shown in the instructions below. Then, you should be able to install, update and run automatic FrozrLock removal.
Was this guide helpful?
Be the first to comment