November 3, 2016

A new malware program was discovered by MalwareHunterTeam that calls itself Smash! Ransomware and uses a cute image of the Super Mushroom from Super Mario Bros holding a knife. Thought it calls itself a ransomware and threatens to delete your files after a timer runs down, in reality this malware is more like a screenlocker and does not delete anything from the computer. Furthermore, many of the functions are not coded yet so this is either a poorly created program or a development version.

When executed, the Smash! will display a series of messages that attempt to welcome you to the program. These messages are displayed below.

When you get to the last message and press OK, it will display a screen with a timer labeled File Kill Timer and then prompts you to enter a 7 digit code to close down the program.

Smash! Ransomware

As of right now, you can type whatever you want into the code box and pressing the button won't do anything. This is because the function that corresponds to clicking the button is currently empty as seen below.

Source code for the Button Click

Furthermore, when the timer runs down it will change the screen to imply it is deleting files from the infected computer. In reality, it is not doing anything as the program does not currently have any ability to delete a victim's files.

Time is Up!

What does currently work is that it blocks certain programs from executing. For example, if you try to run Regedit, Task Manager, or a CMD prompt, it will attempt terminate the process and display a message box stating that the programs are blocked.

Ultimately, with its lack of dangerous functionality and by using characters from Super Mario Bros, Smash! Ransomware is cute rather than damaging. As this malware does not configure an autostaryou can simply reboot your computer and the infection will no longer be running on login.

News Courtesy : http://www.bleepingcomputer.com/news/security/smash-ransomware-is-cute-rather-than-dangerous/