Ransirac
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 90 % (High) |
| Infected Computers: | 11 |
| First Seen: | October 3, 2012 |
| Last Seen: | May 20, 2023 |
| OS(es) Affected: | Windows |
Ransirac is a family of ransomware Trojans and characterized because Ransirac uses fake messages from GEMA (Gesellschaft für musikalische Aufführungs), a German association that protects music intellectual property rights. Due to the widespread use of music files from unknown sources, Ransirac takes advantage of victims' guilt by threatening them so that they will pay an elevated fine. There are many variants of the Ransirac Trojan, also commonly known as GEMA ransomware. The original version of Ransirac was first detected in February of 2012 with additional variants being released in the months that followed. Despite the fact that Ransirac uses a threatening message that looks highly realistic, it is important for computer users to remember that Ransirac is not associated in any way with GEMA and that this malicious message is actually part of a ransomware attack designed to steal your money.
How Ransirac Tries to Trick You into Paying Its Ransom
Ransirac carries out an attack that is typical of these kinds of malware threats. Ransirac will install itself on the victim's computer using another Trojan infection or through a social engineering attack. Once installed, Ransirac will block access to the victim's Task Manager, Registry Editor, Desktop, file and other Windows components, and instead displaying a large, intrusive message claiming that the victim's computer was involved in violating intellectual property rights. It threatens to prosecute unless the victim pays a fine of one hundred Euros. To make its message even more authentic, Ransirac uses GEMA's actual HTML style sheets and images from their website. However, ESG security researchers note that Ransirac has no connection with GEMA and is actually a malware attack. Because of this, you should avoid paying Ransirac's ransom, especially since ESG malware analysts have observed that Ransirac will not be removed after doing so.
While most security programs can detect and remove Ransirac with few problems, the main difficulty for most computer users will be actually gaining access to their security software and bypassing Ransirac's malicious message. Fortunately, this can be done with the help of an external memory device to start up Windows. Safe Mode can also help, although it may be necessary to gain access to security software or the registry editor by using the command prompt. Most importantly, you should not pay the fine that Ransirac demands in its threatening message.
Submit Comment
Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.