A new screenlocker-wiper software called StalinLocker, or StalinScreamer, was recently discovered by MalwareHunterTeam. The software gives you 10 minutes to enter a password or it will attempt to erase the contents of your computer's disks. At the same time, it will display an image of Stalin on your screen and play the USSR anthem.
Its procedures are as follows:
- Extracts the file “USSR_Anthem.mp3” to the %UserProfile%\AppData\Local folder and then runs it.
- It creates a copy of the executable file in %UserProfile%\AppData\Local\ and sets it in autorun mode to start when the user logs on to Windows.
- It creates a dat file in the %UserProfile%\AppData\Local\fl.dat folder and calculates the remaining time divided by 3. So every time you start the computer, the countdown starts.
- An attempt is being made to terminate various processes.
- Terminates Explorer.exe and taskmgr.exe.
- It tries to create a scheduled task called “Driver Update” to launch the Stalin.exe file. (This part of the code seems to be problematic and not working properly).
StalinLocker will then display the above lock screen containing a 10-minute countdown until your files are deleted unless you enter a password. According to MalwareHunterTeam, this password is derived by subtracting the current execution date of the program from the date 1922.12.30. If the user enters the correct password, the program will stop and delete the autorun file.
On the other hand, if the password is not entered by the time the countdown reaches zero, the screenlocker will attempt to delete all files on every drive on the computer. This is accomplished by going through all drive letters from A to Z and deleting those that are accessible.
Overall, StalinLocker is still in development mode, but it is very likely that we will see its final version very soon. Fortunately, most antivirus programs detect it, so make sure you have some protection program installed.
