A new in-development screenlocker/wiper called StalinLocker, or StalinScreamer, was discovered by MalwareHunterTeam that gives you 10 minutes to enter a code or it will try to delete the contents of the drives on the computer. While running, it will display screen that shows Stalin while playing the USSR anthem and displaying a countdown until files are deleted.
When executed, StalinLocker will perform the following actions:
StalinLocker will then display the above lock screen that contains a 10 minutes countdown until your files are deleted or you enter a code. According to MalwareHunterTeam, this code is derived by subtracting the current date of when the program was executed by the date 1922.12.30. If the user enters the correct code, the wiper will exit and delete the autorun.
On the other hand, if the code is not entered by the time the countdown reaches zero, the screenlocker will attempt to delete all of the files on each drive letter found on the computer. This is done by going through all drive letters from A to Z and deleting any that are accessible as shown below.
This wiper is currently in development, but could easily be made into a workable state. Thankfully, most security vendors are detecting this either through definitions or heuristics, so make sure that you have an anti-virus program installed and updated to the latest definitions.
%UserProfile%\AppData\Local\fl.dat %UserProfile%\AppData\Local\stalin.exe %UserProfile%\AppData\Local\USSR_Anthem.mp3