A new ransomware has been discovered called StalinLocker, or StalinScreamer, that gives victims of the attack 10 minutes to put in the correct unlock code and if they’re not able to do that, erases all the data on the infected device.
The ransomware does not actually demand any ransom, other than the condition given to unlock the victim’s device.
Named after Joseph Stalin, the late leader of the Soviet Union, the malware pays tribute to him by showing a red screen with a picture of Stalin, along with the USSR anthem playing in the background, when StalinLocker takes over the computer and the 10 minute countdown begins.
The ransomware was discovered by MalwareHunterTeam, which on Twitter explained how the malware worked and how to know the code to unlock your locked device.
StalinLocker / StalinScreamer sample: https://t.co/turcpk4oVx— MalwareHunterTeam (@malwrhunterteam) May 14, 2018
When run, it drops and plays in the background a file called "USSR_Anthem.mp3".
It gives 600+60 seconds to enter the key, else, it will wipe all it can (code for that on 2nd screenshot).@BleepinComputer @demonslay335 pic.twitter.com/bDpIKbS1ja
According to them, the code can be guessed by subtracting the date the malware was run by 30/12/1922, which is the date that represents the foundation of the USSR.
There is no help on that picture about the key as I see...— MalwareHunterTeam (@malwrhunterteam) May 14, 2018
See screenshot for how the key is calculated.
n = current date when the sample is executed
dt = 1922.12.30
So the key is: n - dt in days. pic.twitter.com/aRQbPZis9m
This ransomware, unlike others, seems to purely focus on destroying user data as it does not demand any ransom in Bitcoin or other ways but simply attempts to erase all data if conditions are not met. If the user correctly enters the code, however, the files are unlocked with no problem.
The malware is similar to a previous one that forced victims to PlayerUnknown’s Battlegrounds game for an hour to get their device unlocked, but unlike StalinLocker, it did not threaten the erasure of the victim’s data.
Currently, StalinLocker is in a testing stage but it could turn out to be a major problem for Windows users once it is out for good.
