Coverton Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
Threat Level: | 100 % (High) |
Infected Computers: | 4 |
First Seen: | March 27, 2016 |
OS(es) Affected: | Windows |
The Coverton Ransomware is a ransomware Trojan. PC security analysts have determined that, unlike many other ransomware infections, paying the Coverton Ransomware ransom may not allow you to regain access to your data. This is one of the reasons why paying the ransom is never a good idea (the other being that it allows con artists to continue creating these threats and profiting from the attacks).
Table of Contents
The Huge Amount of Files that can be Encrypted by the Coverton Ransomware
The Coverton Ransomware is a typical encryption ransomware variant. Like most ransomware infections, the Coverton Ransomware may be spread using corrupted email attachments that may be contained in spam email spam messages. The Coverton Ransomware, once opened, looks through the victim's computer and encrypts all files that it finds that match a list of extensions in its configuration files. The Coverton Ransomware is particularly unique in that it encrypts an incredibly large amount of file types; 950 different extensions are contained in its most recent configuration files! Once the Coverton Ransomware encrypts a file, it changes its extension to Coverton, CZVXVE or ENIGMA, depending on the variant of the Coverton Ransomware that has targeted that victim's computer.
The Powerful Encryption Methods Used by the Coverton Ransomware
The Coverton Ransomware combines AES and RSA encryption, making it impossible for PC security analysts to create a decryption utility or help computer users recover their files. The Coverton Ransomware delivers ransom notes in several formats by dropping text and HTML files. The instructions in the Coverton Ransomware ransom note instruct computer users to pay a ransom of one BitCoin, which would amount to several hundred dollars. The Coverton Ransomware prevents other methods of recovery by deleting Shadow Volume copies of encrypted files and disabling the System Restore.
Issues Regarding Decryption After a Coverton Ransomware Attack
Numerous computer users have reported that even after paying the Coverton Ransomware ransom, they were not able to recover their files (which is not always the case when dealing with other encryption ransomware families like TeslaCrypt, CryptoWall or CTB-Locker). It is not certain if this is a deliberately misleading step or if the decryption process carried out by the creators of the Coverton Ransomware is simply faulty. This is not good news for the creators of the Coverton Ransomware; if computer users have no reason to believe that they will regain access to their files after paying the ransom, then any incentive to pay that ransom, instead of simply cutting their losses, is completely gone.
The Extensions Targeted by the Coverton Ransomware
The Coverton Ransomware, by far, targets more extensions than any other encryption ransomware Trojan observed before. Here is a full list of the file extensions that the Coverton Ransomware searches for and encrypts as part of its attack:
1cd, 1st, 2bp, 3dm, 3ds, 3fr, 4db, 4dl, 4mp, 73i, 7z, 7z001, 7z002, 8xi, 9png, a00, a01, a02, a3d, abm, abs, abw, accdb, accdc, accde, accdr, accdt, accdw, accft, ace, act, adn, adp, af2, af3, aft, afx, agg, agif, agp, ahd, ai, aic, aim, ain, albm, alf, alz, ani, ans, apd, apm, apng, aps, apt, apx, apz, ar, arc, arh, ari, arj, ark, art, artwork, arw, asc, ascii, ase, ask, asp, aspx, asw, asy, aty, avatar, awdb, awp, awt, aww, axx, azz, b1, b64, ba, backup, bad, bak, bay, bbs, bdb, bdp, bdr, bean, bh, bhx, bib, blend, blkrt, bm2, bmp, bmx, bmz, bna, bnd, bndl, boc, bok, boo, brk, brn, brt, bss, btd, bti, btr, bz, bz2, bza, bzabw, bzip, bzip2, c00, c01, c02, c10, c4, c4d, cal, cals, can, car, cb7, cba, cbr, cbz, cd5, cdb, cdc, cdg, cdmm, cdmt, cdmtz, cdmz, cdr, cdr3, cdr4, cdr6, cdrw, cdt, cdz, cf, cfu, cgm, chart, chord, cimg, cin, cit, ckp, clkw, cma, cmx, cnm, cnv, colz, cp9, cpc, cpd, cpg, cps, cpt, cpx, cr2, crd, crwl, css, csv, csy, ct, cv5, cvg, cvi, cvs, cvx, cwt, cxf, cyi, czip, daconnections, dacpac, dad, dadiagrams, daf, daschema, db, db2, db3, dbc, dbf, dbk, dbs, dbt, dbv, dbx, dc2, dca, dcb, dcr, dcs, dct, dcx, dd, ddl, ddoc, dds, deb, ded, design, df1, dgc, dgn, dgs, dgt, dhs, dib, dicom, dist, diz, djv, djvu, dm3, dmi, dmo, dnc, dne, doc, docm, docx, docxml, docz, dot, dotm, dotx, dp1, dpp, dpx, dqy, drw, drz, dsk, dsn, dsv, dt, dt2, dta, dtsx, dtw, dvi, dvl, dwg, dx, dxb, dxf, dxl, dz, eco, ecs, ecw, ecx, edb, efd, efw, egc, eio, eip, eit, email, emd, emf, emlx, ep, epf, epi, epp, eps, epsf, eql, erf, err, etf, etx, euc, exr, f, fadein, fal, faq, fax, fb2, fb3, fbl, fbx, fcd, fcf, fdb, fdf, fdp, fdr, fds, fdt, fdx, fdxt, fes, fft, fh10, fh11, fh3, fh4, fh5, fh6, fh7, fh8, fic, fid, fif, fig, fil, flc, fli, flr, fm5, fmp, fmp12, fmpsl, fmv, fodt, fol, fountain, fp3, fp4, fp5, fp7, fp8, fpos, fpt, fpx, frt, ft10, ft11, ft7, ft8, ft9, ftn, fwdn, fxc, fxg, fzb, fzv, g3, gca, gcdp, gdb, gdoc, gdraw, gem, geo, gfb, gfie, ggr, gif, gih, gim, gio, glox, gmbck, gmspr, gmz, gpd, gpn, gro, grob, grs, gsd, gthr, gtp, gv, gwi, gz, gz2, gza, gzi, gzip, ha, hbc, hbc2, hbe, hbk, hdb, hdp, hdr, hht, his, hki, hki1, hki2, hpg, hpgl, hpi, hpl, hs, htc, html, hwp, hz, i3d, ib, icn, icon, icpr, idc, idea, idx, igt, igx, ihx, iil, iiq, imd, info, ink, int, ipf, ipx, itc2, itdb, itw, iwi, j, j2c, j2k, jarvis, jas, jb2, jbig, jbig2, jbmp, jbr, jfif, jia, jis, jng, joe, jp1, jp2, jpe, jpeg, jpg, jpg2, jps, jpx, jrtf, jtf, jtx, jwl, jxr, kdb, kdbx, kdc, kdi, kdk, kes, kic, klg, knt, kon, kpg, kwd, latex, lbm, lbt, lgc, lis, lit, ljp, lmk, lnt, lp2, lrc, lst, ltr, ltx, lue, luf, lwo, lwp, lws, lxfml, lyt, lyx, m3d, ma, mac, maf, man, map, maq, mat, max, mb, mbm, mbox, md5txt, mdb, mdbhtml, mdf, mdn, mdt, me, mef, mell, mft, mgcb, mgmf, mgmt, mgmx, mgtx, mhtml, min, mmat, mng, mnr, mnt, mobi, mos, mpf, mpo, mrg, mrxs, msg, mt9, mud, mwb, mwp, mxl, myd, myl, ncr, nct, ndf, nfo, njx, nlm, notes, now, nrw, ns2, ns3, ns4, nsf, nv2, nwctxt, nyf, nzb, obj, oc3, oc4, oc5, oce, oci, ocr, odb, odm, odo, ods, odt, ofl, oft, omf, openbsd, oplc, oqy, ora, orf, ort, orx, ota, otg, oti, ott, ovp, ovr, owc, owg, oyx, ozb, ozj, ozt, p7s, p96, p97, pages, pal, pan, pano, pap, pbm, pc1, pc2, pc3, pcd, pcs, pcx, pdb, pdd, pdf, pdm, pdn, pe4, pef, pfd, pff, pfi, pfs, pfv, pfx, pgf, pgm, phm, php, pi1, pi2, pi3, pic, pict, pix, pjpeg, pjpg, pjt, pl, plantuml, plt, pm, pmg, png, pni, pnm, pntg, pnz, pobj, pop, pp4, pp5, ppm, ppt, pptm, pptx, prt, prw, ps, psd, psdx, pse, psid, psp, pspbrush, psw, ptg, pth, ptx, pu, pvj, pvm, pvr, pwa, pwi, pwr, px, pxr, pz3, pza, pzp, pzs, qdl, qmg, qpx, qry, qvd, ras, raw, rctd, rcu, rdb, rdl, readme, rft, rgb, rgf, rib, ric, riff, ris, rix, rle, rli, rng, rpd, rpf, rpt, rri, rs, rsb, rsd, rsr, rst, rt, rtd, rtf, rtx, run, rw2, rwl, rzk, rzn, s2mv, s3m, saf, safetext, sai, sam, save, sbf, scad, scc, sci, scm, scriv, scrivx, sct, scv, scw, sdb, sdf, sdm, sdoc, sdw, sep, sfc, sfera, sfw, sgm, sig, sk1, sk2, skcard, skm, sla, slagz, sld, sldasm, slddrt, sldprt, sls, smf, smil, sms, snagitstamps, snagstyles, sob, spa, spe, sph, spj, spp, spq, spr, sqb, sql, sqlite, sqlite3, sqlitedb, sr2, srw, ssa, ssfn, ssk, st, ste, stm, stn, stp, str, strings, stw, sty, sub, sumo, sva, svf, svg, svgz, swf, sxd, sxg, sxw, t2b, tab, tb0, tbn, tcx, tdf, tdt, te, teacher, tex, text, tfc, tg4, tga, thm, thp, thumb, tif, tiff, tjp, tlb, tlc, tm, tm2, tmd, tmv, tmx, tn, tne, tpc, tpi, trelby, trm, tvj, txt, u3d, u3i, udb, ufo, ufr, uga, unauth, unity, unx, uof, uot, upd, usr, utf8, utxt, v12, vault, vbr, vct, vda, vdb, vec, vff, vml, vnt, vpd, vpe, vrml, vrp, vsd, vsdm, vsdx, vsm, vst, vstm, vstx, vue, vw, wb1, wbc, wbd, wbk, wbm, wbmp, wbz, wcf, wdb, wdp, webdoc, webp, wgz, wire, wlmp, wmdb, wmf, wn, wp, wp4, wp5, wp6, wp7, wpa, wpb, wpd, wpe, wpg, wpl, wps, wpt, wpw, wri, wsc, wsd, wsh, wtx, wvl, x, x3d, x3f, xar, xbdoc, xbplate, xdb, xdl, xhtml, xld, xlf, xlgc, xls, xlsm, xlsx, xmind, xmmap, xpm, xps, xwp, xy3, xyp, xyw, y, yal, ybk, yml, ysp, z3d, zabw, zdb, zdc, zif, zw.
The Coverton Ransomware drops text and HTML file ransom notes named "!!!-WARNING-!!!.html" and "!!!-WARNING-!!!.txt" in every folder where it has encrypted files. The Coverton Ransomware's ransom note alerts the victim of the attack and contains information for accessing the DarkNet website that allows the victims to make payments via Tor and BitCoins.
SpyHunter Detects & Remove Coverton Ransomware
File System Details
# | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
---|---|---|---|
1. | crrss.exe | c5c4f4860c69ea7469ca3be3caf5bf18 | 4 |
2. | 16948cbcbae291ceafae7145e8d02a93988fcfc7f8ce6d72e1d1e09a87d349e4.exe | 2fdfe3228577f043acdc302c0e351b81 | 0 |
3. | 59bc05ad9a59fcb2782d415c413ebb47c952306cb93f6b49a1bd264abb101bf7.exe | 93c66b794eae6549b4c6d2c518bc6db9 | 0 |
4. | f5f9ce7b75289d0caaa278c1e7c426cce6aab4033f1100d492fca41000016b0a.exe | b7e1ce8db3cde548ee3b9f9e61841395 | 0 |