Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Alma Locker Virus Remove and Restore Your Files

STF-alma-locker-ransomware-virus-skull-logo-screen-site

Alma Locker virus is a recent ransomware discovered by a malware researcher from Proofpoint security. The researcher has found that the virus spreads via the RIG Exploit Kit. The ransomware encrypts nearly 90 file types. Victims have five days to pay the ransom or otherwise the price will increase. The ransom that the crypto-virus asks is 1 BitCoin, which currently is in the vicinity of 580 US dollars.

Read this article carefully to see how to remove the virus and try to decrypt your files.

Threat Summary

Name Alma Locker
Type Ransomware
Short Description The ransomware will encrypt your files and display a ransom note. You are given five days to pay, and after that period the ransom price will increase.
Symptoms The ransomware will encrypt files, and put an extension to them. The extension consists of five random symbols.
Distribution Method Executables, Spam Emails, File Sharing Networks
Detection Tool See If Your System Has Been Affected by Alma Locker

Download

Malware Removal Tool

User Experience Join Our Forum to Discuss Alma Locker.

Alma Locker Virus – Infection Spread

Alma Locker ransomware virus is spread through the RIG Exploit Kit, according to the Proofpoint security researcher Darien Huss.

However, that does not exclude the possibility of the ransomware to spread using other methods. It might spread an executable file, placing it inside spam emails as an attachment. Upon opening attachments from such suspicious emails or another place with an unknown origin, your computer can get infected. Social media networks and file-sharing services might also contain such a file somewhere inside them if cybercriminals put them there. Thus, you should always be on a high alert and careful with your clicks, downloads and when you open files. We also could see another Exploit Kit serving the payload file of the ransomware.

Alma Locker Virus – Technical Overview

Alma Locker is a ransomware virus. Darien Huss, a malware researcher, working at Proofpoint security, had discovered it in the wild just one day ago. He also found that Alma Locker ransomware has an active Command & Control server on the TOR network. Note that the ransomware will send the following information to its C&C server:

  • AES-128 private decryption key
  • file extension put to encrypted files
  • user name
  • the name of the active network interface
  • the system Locale ID (LCID)
  • the version of your Operating System (OS)
  • the name of your security software

Afterward, Alma Locker ransomware will encrypt files and place a picture as a lock-screen, which is the ransom note. You can see image of it here:

STF-alma-locker-ransomware-virus-ransom-note

If you follow any of the consecutive links, you will see this page in your browser:

STF-alma-locker-ransomware-virus-site-page

From there you can log in with your unique ID and download the Alma Locker decrypter program. Unfortunately, their site gives an error if you try decrypting some files for free, so you are left with the following decrypter:

STF-alma-locker-ransomware-virus-decryptor

There is a period of 120 hours or in other words, five full days, for you to pay the price which is asked. If the condition is not met, the initial price will be increased. The ransom price asked, in the beginning, is 1 Bitcoin and is equal to 580 US dollars. It is not advised to pay these cyber criminals – if you pay them, there is no guarantee that you will unlock your files, and you will only aid them in their criminal activity.

Alma Locker ransomware will search for files to encrypt, which have nearly 90 different file extensions. You could see the full list here:

→.1cd, .3ds, .3gp, .accdb, .ape, .asp, .aspx, .bc6, .bc7, .bmp, .cdr, .cer, .cfg, .cfgx, .cpp, .cr2, .crt, .crw, .csr, .csv, .dbf, .dbx, .dcr, .dfx, .dib, .djvu, .doc, .docm, .docx, .dwg, .dwt, .dxf, .dxg, .eps, .htm, .html, .ibank, .indd, .jfif, .jpe, .jpeg, .jpg, .kdc, .kwm, .max, .mdb, .mdf, .odb, .odc, .odm, .odp, .ods, .odt, .orf, .p12, .p7b, .p7c, .pdf, .pef, .pem, .pfx, .php, .png, .pps, .ppt, .pptm, .pptx, .psd, .pst, .pub, .pwm, .qbb, .qbw, .raw, .rtf, .sln, .sql, .sqlite, .svg, .tif, .tiff, .txt, .vcf, .wallet, .wpd, .xls, .xlsm, .xlsx, .xml

Source: Bleeping Computer

All files will get locked with a 128-bit AES encryption algorithm. Also, files and their extension will not be changed, but rather a second extension will be added to them, which has five random characters. As for the victim ID – it is created from the serial number of the C:\ drive and the MAC address of the first network interface. You can follow the discussion in our forum and see an encrypted file’s extension posted by a user there.

You can see that the ransomware uses an executable file named syncli.exe and it is already being detected from a number of security programs based on an analysis from the VirusTotal platform:

STF-alma-locker-ransomware-virus-detections-virustotal

It is still not known whether the Alma Locker ransomware virus erases the Shadow Volume Copies of the Windows operating system, but that has a fairly high probability.

Remove Alma Locker Virus and Restore Your Files

If your computer got compromised and is infected with the Alma Locker ransomware virus, you should have some experience with removing viruses before tampering with it. You should get rid of the ransomware fast before it can spread further on the network and encrypt more files. The recommended action for you is to remove the ransomware completely by following the step-by-step instructions written below.

Manually delete Alma Locker from your computer

Note! Substantial notification about the Alma Locker threat: Manual removal of Alma Locker requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Alma Locker files and objects.
2. Find malicious files created by Alma Locker on your PC.
3. Fix registry entries created by Alma Locker on your PC.

Automatically remove Alma Locker by downloading an advanced anti-malware program

1. Remove Alma Locker with SpyHunter Anti-Malware Tool
2. Back up your data to secure it against infections and file encryption by Alma Locker in the future
3. Restore files encrypted by Alma Locker
Optional: Using Alternative Anti-Malware Tools

Berta Bilbao

Berta is the Editor-in-Chief of SensorsTechForum. She is a dedicated malware researcher, dreaming for a more secure cyber space.

More Posts - Website

Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.