Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


GruxEr Ransomware – Decrypt Encrypted Files for Free

This article aims to help you remove the Gruxer ransomware infection and restore the AES encrypted files by this ransomware virus.

A ransomware infection going by the name GruxEr has been reported to encrypt the files on the computers it infects and then demand a ransom of $250 in BitCoin from the victims to get the files back. The virus has been detected at the beginning of May 2017 and it has been reported to wreak havoc ever since. It drops a ransom note which asks victims not to shut down their computer or else the files will be permanently lost. In case your computer has been infected by the GruxEr ransomware threat, you should read the following article thoroughly to learn how to remove it from your computer and restore files encrypted by this infection. Be advised to attempt anything suggested in this article and it’s instructions solely at your own risk!

GruxEr Ransomware – How Does It Spread

The distribution of GruxEr ransomware has been reported to be conducted in multiple different methods. The primary methods of those is via spreading a Trojan-type of executable via fake updates, game patches, key generators or other online file sharing services. The executable of GruxEr ransomware has been detected to be the following:

As soon as the malicious executable of GruxEr ransomware has been opened, the virus drops multiple files on the victim’s computer, predominantly located in %Temp% directory. The files are reported to have the following name:

  • GRUXER.EXE
  • TEARS.EXE
  • WORM.EXE

One of the files hints of a possible method of spreading the GruxEr ransomware via a worm infection, which is particularly dangerous. The main reason for this is that worms unlike other malware may spread automatically from a computer to computer via open ports of the network or automatically generated requests.

GruxEr Ransomware – In Depth Analysis

Believed to use the HiddenTear source code for file encryption, called Tears, the virus initially begins to block the screen of the user’s computer using the GRUXER.EXE module. The blocked screen has the following ransom note:

Your documents, photos, databases and other important files have been encrypted with the strongest encryption known to man. And is secured with a unique key, generated for this computer. The private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay to obtain your key.
You must pay $250 in Bitcoin to the bitcoin address below.If you do not have Bitcoin visit the site Localbitcoins and purchase $250 USD worth of bitcoin. Within 2 minutes of recieveing your payment, an automated bot will send your computer your personal decryption key.
You have 72 hours to submit the payment. If you do not send the money within the provided time, all your files will be permanently crypted and no one will ever be able to recover them.

After this, the GruxEr virus encrypts the files on the compromised computer and it’s final phase is to keep spreading by a .JPG infection worm, via the WORM.EXE module. This infector looks for JPG files and rewrites the beginning of those files using PNG file architecture.

GruxEr Ransomware – Encryption Process

The process of encrypting files is performed via the TEARS.EXE module. When it is activated, it begins to apply the AES encryption algorithm which generates a decryption key afterwards. The files that the virus may target are believed to be the following types:

→ “PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”Source:fileinfo.com

After it encrypts the files on the compromised computers, the virus may add the following text in their strings:

“Files has been encrypted with hidden tear
Send me some bitcoins or kebab
And I also hate night clubs desserts, being drunk.”

Fortunately files encrypted by this ransomware virus may be decryptable, since it is part of the hidden tear ransomware viruses. But first, it is very important to remove the files that are malicious from your computer and the registry objects as well as other settings. To do this, we advise you to follow the instructions underneath.

Remove GruxEr Ransomware

Before begging to remove GruxEr from your computer, we strongly suggest that you extract the encrypted files. However, the ransomware appends a lockscreen via the GRUXER.EXE module. And what is worse is that the virus warns you that the files will be permanently lost if your computer is shut down. This is believed to be a scareware message, but we strongly advise not to rely on this information.

The best course of action is to turn off your computer by force, by cutting the power to it, whether it is via the power source or battery (laptop). Then, we advise following the below-mentioned steps:

1. Download a live operating system on your computer which boots from a flash drive. Make sure the live OS is Windows and has what is known as AntiWinLocker which unlocks folders of Windows if you boot from a live OS and bypasses user accounts. One of those live Windows OS’s is called Windows 7 LiveCD [Xemom1]. You can find it on many torrent sites.

2. Install the live OS on a flash drive via software, such as Rufus. If you are having difficulty using rufus, you can follow the instructions on our forum. Use a safe PC, not the one you just turned off.

3. The final step is to follow these instructions in order to boot your computer without risk. This can happen if you remove it’s hard drive and attach it to another safe PC so that you can access the encrypted files and copy them to the Safe PC.

We prefer to give you the “hands-on approach” because it is less complicated and can bypass any Windows login screens, etc. But for this to work, you will need the following tools:

A crossed screwdriver, preferably with changeable tips. For smaller screws.
cross-screwdriver-sensorstechforum
A SATA cable or SATA to USB external drive converter box. Usually, costs around 10$ to 20$.
external-drive-disconnected-sensorstechforum
A USB-to-USB cable, male on both sides. (Usually, it is included in a SATA to USB External drive maker kit)

Now it is time to get down to business. Before beginning, bear in mind that even if you have a desktop PC, the instructions do not differ much, because the same principles are applied. We have decided to perform those instructions for laptops because they are most widely spread amongst other PCs.

Step 1: Remove the battery from your laptop and unscrew the screws from it to remove the hard drive, like the pictures below display:

sensorstechforum-laptop-remove-bolts-sensorstechforum

hard-drive-removal-sensorstechforum-768x432

Step 2: Make sure to extract the module with SATA conversion board and port and insert the SATA drive into it.

external-drive-disconnected2-sensorstechforum

Step 3: Connect the drive to your computer. It should display as a “Removable Disk” or “Local Drive” with a drive letter other than your original drives. (ex. G:, E:, F:)

drive-sensorstechforum-unmounted

Step 4: Copy your files. Now all that is left for you is to access your files, depending on where they are located. If your drive has two partitions, you will see this as two removable drives connected to your computer. In case you keep all your important files in only one partition, and cannot find them on the primary drive, you should go to the following location to access your profile:

DriveLetter:\Users\{Username}\

There you should be able to see all of your profile’s folders:

important-folders-windows-sensorstechforum

After having done this, we advise you to copy the files onto an external drive or better – write them on a disk so that they are safe and unmodifiable by any malware or crashes that may occur on your computer.

IMPORTANT! MAKE SURE THAT THE SAFE PC IS OFFLINE AND HAS ACTIVE ANTIVIRUS PROTECTION, BECAUSE THE VIRUS HAS WORM SPREADING CAPABILITY! COPY ONLY THE IMPORTANT FILES!

Then, you can boot your computer into Safe Mode and safely remove the virus files, by following the instructions down below. Malware researchers strongly advise to remove the Lockscreen first, by locating the string ScreenSaver:

HKCU\Control Panel\Desktop

To open the Windows registry editor, first boot in Safe Mode:

Boot Your PC In Safe Mode to Recover Your Files

Then hold the WIN + R keys and in the box type regedit. From it’s search bar on the top right, you can type the registry string names for the screensaver. When you remove it, you may remove the lockscreen.

Then you can restart your computer and remove the malware. The best method to remove GruxEr is to scan your computer with an advanced anti-malware software. This will help you to completely get rid of the threat and all settings it has changed.

Automatically remove GruxEr by downloading an advanced anti-malware program

1. Remove GruxEr with SpyHunter Anti-Malware Tool and back up your data

After removing the virus, you can now begin to decrypt the backed up encrypted files by following the decryption instructions below.

How to Decrypt Files Encrypted by GruxEr

The file-decryption process of HiddenTear ransomware viruses, like GruxEr is not as difficult, but you need to be prepared and do it from a safe computer that is powerful. Let’s begin!

Step 1: Download the HiddenTear BruteForcer by clicking on the button below and open the archive:

Download

HiddenTear Bruteforcer


1-hidden-tear-bruteforcer-download-sensorstechforum

Step 2: Extract the program onto your Desktop or wherever you feel comfortable to easily access it and open it as an administrator:

2-hidden-tear-bruteforcer-extract-sensorstechforum

Step 3: After opening it, you should see the main interface of the brute force. From there, choose “Browser Sample” to select a sample encrypted file of the type of ransomware you are trying to decrypt:

3-Hiddentear-sensorstechforum-bruteforcer-main-panel

Step 4: After this select the type of ransomware from the down-left expanding menu:

4-hidden-tear-choose-ransowmare-variant-sensorstechforum

Step 5: Click on the Start Bruteforce button. This may take some time. After the brute forcing is finished and the key is found, copy it and save it somewhere on your PC in a .txt file, you will need it later.

Step 6: Download the HiddenTear Decryptor from the download button below:

Download

HiddenTear Decrypter

Step 7: Extract it and open it, the same way with HiddenTear Bruteforcer. From it’s primary interface, paste the key copied from the BruteForcer, write the type of extension being used by the ransomware and click on the Decrypt button as shown below:

5-hiddentear-decrypter-password-decrypt-sensorstechforum

After these steps have been completed, you should immediately copy your files to an external device so that they are safe. After this has been done, we strongly recommend completely wiping your drives and reinstalling Windows on the affected machine.

GruxEr Decryption – Conclusion

Viruses like the GruxEr variants are becoming more and more common. Researchers, publish many projects online with the goal to stop ransomware, but this represents an opportunity to coders that develop ransomware and either start infecting users with it or put it up for sale in the deep web. With the expanding of ransomware variants lately, we predict seeing even more infected systems than the year 2015. This is why we advise you to follow our recommendations for securing your computer below:

Advice 1: Make sure to read our general protection tips and try to make them your habit and educated others to do so as well.
Advice 2: Install an advanced anti-malware program that has an often updated real-time shield definitions and ransomware protection.

Download

Malware Removal Tool


Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter

Advice 3: Seek out and download specific anti-ransomware software which is reliable.

Advice 4: Backup your files using one of the methods in this article.

Advice 5: : Make sure to use a secure web browser while surfing the world wide web.

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.