Trojan.Ransom.AB
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 90 % (High) |
| Infected Computers: | 0 |
| First Seen: | February 22, 2013 |
| OS(es) Affected: | Windows |
PC security researchers have issued warnings about Trojan.Ransom.AB, a generic malware detection typically used to denote Police Ransomware and Winlocker infections. These kinds of Trojans have been around for several years and use a well known scam to steal money from inexperienced computer users. Using a Winlocker, Trojan.Ransom.AB scares its victims by making threatening messages, which appear to come from a police agency. These messages claim that the victim visited illegal pornographic websites or used copyrighted material without permission.
Variants of Trojan.Ransom.AB Are Netting Huge Profits for Criminal Organizations
Recently, real police agencies took down a large criminal organization responsible for numerous schemes involving Trojan.Ransom.AB variants. These scams have spread to more than thirty countries around the world, always following the same pattern:
- Trojan.Ransom.AB locks the victim out of the infected computer, freezing the infected computer.
- Trojan.Ransom.AB then displays a threatening message claiming that the infected computer was involved in illegal activities.
- Finally, the Trojan.Ransom.AB Trojan demands payment of a ransom using a money transfer service.
These kinds of scams allow criminal gangs to make millions of Euros in profits. Unfortunately, the arrest of the individuals belonging to the criminal organization mentioned above will likely only be a dent in a massive scheme involving numerous variants of these attacks. Trojan.Ransom.AB variants are being distributed by numerous different criminal organizations all looking to cash in the massive potential profits involved in this scam. Since the first variants of these kinds of attacks, ESG security researchers have detected dozens of Police Ransomware families, all using some kind of variant of the Trojan.Ransom.AB scam.
While there are several ways Trojan.Ransom.AB spreads from one computer to another, it seems that one of the preferred ways to spread this particular infection is using exploit kits. These are dangerous hacking tools that are set up on an attack website in order to infect visitors' computers with Trojan.Ransom.AB by exploiting known application and operating system vulnerabilities. Computer users are directed to attack websites containing an exploit kit after visiting a compromised website that contains malicious scripts. Trojan.Ransom.AB can also spread by spam email messages and through fake video codec or torrent downloads contained in unsafe websites such as pornographic websites or web pages dedicated to peer-to-peer file sharing of popular media files.
