RANSOM is the Trend Micro detection for most ransomware. Most ransomware are known to restrict the user from fully accessing the system. It also encrypts files and demands a ransom to be paid in order to decrypt or unlock the infected machine.

Ransomware infects computers through various means. Most of ransomware come as a macro or JavaScript attachment in spammed email. Some are delivered as a link, also in spammed email. Others are delivered by exploit kits. Some others are delivered via malvertisements or compromised websites.

To prevent ransomware, users should use protection that also covers against spam and malicious links. Also, make sure to regularly create backup copies of all important files.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be unknowingly downloaded by a user while visiting malicious websites. It may arrive using one or multiple arrival methods.

Behaviors

• Resides in memory
• Created mutex
• Created multiple copies of a file
• Process Termination

Capabilities

• Backdoor commands

Impact

• Compromise system security - with backdoor capabilities that can execute malicious commands

Infection Routine

Click image to enlarge.