ScareCrow Ransomware - What Is it and How Does it Work?
Our research team recently discovered ScareCrow, a ransomware-type program, while investigating new submissions to VirusTotal. After executing a sample on our test system, we noticed that the ransomware encrypted files and appended their titles with a ".CROW" extension. For instance, "1.jpg" became "1.jpg.CROW", and "2.png" was changed to "2.png.CROW". A ransom note – "readme.txt" – was also created after encryption was completed.
The ransom note does not provide much information other than informing victims that their data has been encrypted and instructing them to contact the attackers for restoration of it. From our experience in researching ransomware infections, we can conclude that decryption is usually impossible without help from the cyber criminals behind the attack; however, victims often do not receive the necessary keys/tools to decrypt their files even after paying up the ransom demands – making it unwise to meet these demands as it only encourages this illegal activity further.
To stop ScareCrow from encrypting more files, it must be removed from the operating system; unfortunately, removal will not restore already compromised data and thus the only solution is to recover them from a backup.
Table of Contents
The full ScareCrow note
The complete text of the ransom note produced by ScareCrow reads as follows:
ScareCrow encrypted your files!
To restore contact us in telegram(desktop.telegram.org):
@ScareCrowRestore1
@ScareCrowRestore2
@ScareCrowRestore3
Your ID: -
How can ransomware like ScareCrow infect your home computer?
Ransomware like ScareCrow can infect a home computer through malicious links or attachments in emails, instant messages, or social media posts. It can also be downloaded from malicious websites, or spread through file-sharing networks. Additionally, it can be installed by other malware that has already infiltrated the system.
What is the best way to protect your files against ransomware attacks?
The best way to protect your files against ransomware attacks is to regularly back up your data and store the backups in a secure, off-site location. Additionally, it is important to keep all software and operating systems up-to-date with the latest security patches, as well as use strong passwords and two-factor authentication whenever possible. Finally, it is also recommended to use reliable antivirus software that can detect and block malicious programs before they can cause any damage.
