ViiperWaRe Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 100 % (High) |
| Infected Computers: | 4 |
| First Seen: | October 18, 2017 |
| Last Seen: | January 8, 2020 |
| OS(es) Affected: | Windows |
The ViiperWaRe Ransomware is an encryption ransomware Trojan that PC security researchers first observed on October 15, 2017. The ViiperWaRe Ransomware is based on HiddenTear, an open source ransomware platform that has been responsible for countless ransomware infections since its first release in August of 2015. The ViiperWaRe Ransomware, such as many other encryption ransomware Trojans that are active currently, is being presented to victims via corrupted spam email attachments. Affected computer users will receive spam email messages with attached Microsoft Word documents that include corrupted scripts that download and install the ViiperWaRe Ransomware when opened. Because of this, any unsolicited email attachments should be handled with caution.
Table of Contents
Your Most Precious Files will be Encrypted by the ViiperWaRe Ransomware
The ViiperWaRe Ransomware is designed to encrypt the user-generated files in its attacks. This means that it will target files such as Microsoft Office documents, videos, images, audio, databases, and configuration files while leaving the Windows system files operational. This allows the victim to view a ransom note and carry out a payment, an advantage over threats that make the victim's computer unusable since this does not allow the con artists to contact the victims and demand any payment type. The ViiperWaRe Ransomware uses a strong encryption method that makes the affected files inaccessible. Some of the files types that may be encrypted in attacks like the ViiperWaRe Ransomware include:
.3gp, .7z, .apk, .avi, .bmp, .cdr, .cer, .chm, .conf, .css, .csv, .dat, .db, .dbf, .djvu, .dbx, .docm, ,doc, .epub, .docx .fb2, .flv, .gif, .gz, .iso .ibooks,.jpeg, .jpg, .key, .mdb .md2, .mdf, .mht, .mobi .mhtm, .mkv, .mov, .mp3, .mp4, .mpg .mpeg, .pict, .pdf, .pps, .pkg, .png, .ppt .pptx, .ppsx, .psd, .rar, .rtf, .scr, .swf, .sav, .tiff, .tif, .tbl, .torrent, .txt, .vsd, .wmv, .xls, .xlsx, .xps, .xml, .ckp, .zip, .java, .py, .asm, .c, .cpp, .cs, .js, .php, .dacpac, .rbw, .rb, .mrg, .dcx, .db3, .sql, .sqlite3, .sqlite, .sqlitedb, .psd, .psp, .pdb, .dxf, .dwg, .drw, .casb, .ccp, .cal, .cmx, .cr2.
The Modest Ransom Demanded by the ViiperWaRe Ransomware
The ViiperWaRe Ransomware displays a program window named 'ViiperWare – Ransomware,' which displays the ViiperWaRe Ransomware's ransom note after the victim's files become encrypted. The ViiperWaRe Ransomware allows the victim to select the language in which the ransom note will be displayed. Unfortunately, once the ViiperWaRe Ransomware encrypts a file, it only can be decrypted with the decryption application that the con artists hold in their possession. The people responsible for the ViiperWaRe Ransomware demand a ransom payment of 20 Euro in exchange for the decryption key, although there is no guarantee that the con artists will deliver the decryption key after the ransom is paid. The full text of the ViiperWaRe Ransomware ransom note reads:
'1.) What Happened to my files?
a. Your Files has been encrypted, what means you're not able to use them anymore until you decrypt them.
2.) Can I recover my FIles?
b. yes of course you can recover them. It's pretty easy to do that but of course it is not free. Just Pay the Price wich is shown below and you will recive your Decryption Key after we received the Payment!
3.) How I got infected with this?
c. Probably you tried to download something illegal from the Internet or you got scammed by someone.
[Enter Decryption|BUTTON] [Pay the Price|BUTTON] Price: 20,00 €'
Dealing with the ViiperWaRe Ransomware
The files encrypted by the ViiperWaRe Ransomware attack can be identified easily because the ViiperWaRe Ransomware adds the file extension '.viiper' to the end of each file's name. PC security experts do not recommend that victims pay the ViiperWaRe Ransomware ransom. Instead, they should restore the affected files from a backup copy if possible. Having file backups on an external device or the cloud is, therefore, the best protection against threats like the ViiperWaRe Ransomware. A good backup system, combined with a security program that is fully up to date, is the best measure to be protected against ransomware Trojans like the ViiperWaRe Ransomware and other, similar threats.
