Karma Ransomware, which pretends to be a Windows optimization program called fakeWindows-TuneUp. What is worse is that this sample was discovered as software that would potentially be distributed by a pay-per-install software monetization company when people install free software downloaded from the Internet.
It turns out that this malicious file-encrypting software was distributed (used to, because currently, this ransomware is no longer active because its Command&Control servers were taken down already) along other freeware and presented as recommended additional software that can help the user speed up a slow computer and fix other perfomance-related issues. This malicious program even used to have an official website; however, it is no longer active. Clearly, scammers had put great efforts into making people believe that Windows-TuneUp is a legitimate tool; however, it didn’t take long to realize that in reality it is a Trojan that disseminates Karma ransomware.
When the victim downloads and installs this program, it automatically launches and pretends to be checking the system for errors and problems that need to be fixed. While the victim explores the panel of this fake optimization tool, the virus actually scans system folders and encrypts target files with a sophisticated cipher. The real intention of this PC optimization software emerges when it triggers a ransom note.
Files associated with the Karma Ransomware
Registry entries associated with the Karma Ransomware
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ “Saffron”= “%Desktop%\\# DECRYPT MY FILES #.html”
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ “Safron”= “%Desktop%\\# DECRYPT MY FILES #.txt”
Finally, users of any computing devices should be careful before downloading any software and decline any free software. Also keep a good anti virus program such as Max Total Security and have peace of mind with advance detection and daily data backup (just in case some ransomware makes it to your files!).