Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


MasterBuster Virus Removal – Restore .hcked Files

stf-masterbuster-ransomware-master-buster-virus-darkwing-ransom-note-message

The malware researcher Karsten Hahn has discovered the MasterBuster ransomware. The virus will encrypt your files with the .hcked extension and display a ransom note with payment instructions afterward. The ransomware is based on the open-source EDA2 project. To see how to remove the ransomware and how you can try to restore your files, read the article in full.

Threat Summary

Name MasterBuster
Type Ransomware, Cryptovirus
Short Description The ransomware will encrypt your files and then display a ransom note with payment instructions.
Symptoms All encrypted files get the extension .hcked appended to them.
Distribution Method Spam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by MasterBuster

Download

Malware Removal Tool

User Experience Join Our Forum to Discuss MasterBuster.
Data Recovery Tool Data Recovery Pro by ParetoLogic Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

MasterBuster Virus – How Does It Infect?

The MasterBuster ransomware might get inside your computer machine by using multiple ways. The payload file could be spread via spam e-mails. The spam mail tactic is designed to make you think that the email and its attached file are important. If you fall for that, you might open the attachment. Then, the malicious content from the file releases the payload and your computer becomes infected. You can see an example of a payload file and its detections from malware vendors on the VirusTotal website right here:

stf-masterbuster-ransomware-master-buster-virus-total-virustotal-detections

MasterBuster ransomware might infect your PC using different methods. For example, the malware creators could distribute the malware file via social media and file-sharing platforms. The file could be presented as a useful or needed application. Refrain from just opening files from unknown sources, especially if they come in the form of e-mails or a link you know nothing about. First, you should do a scan with a security tool and check the size and signatures of the file. You should read the ransomware prevention tips from the thread in the forum section.

MasterBuster Virus – What Does It Do?

The MasterBuster ransomware is a cryptovirus that is targeting users from Bangladesh and India. The malware researcher Karsten Hahn from G Data has found a malware sample in the wild. The ransomware is written on the open-source EDA2 (Hidden Tear) project.

Your files will get encrypted and afterward the extension .hcked will be appended to every one of them. The instructions with demands are written in two different files, one of which launches as a screen on your desktop.

MasterBuster connects to the following remote locations:

  • http://decrypt.ez.lv/ddrt/writ[redacted]
  • https://docs.google.com/forms/d/1dUrtnhlouJBZKyJjPU4x_nvbXO2jkd8vf7nkI_7DOl0/view[redacted]

Information such as your computer name, user name, password and the current date can be sent to those two locations.

When the MasterBuster ransomware launches its payload, it can create entries in the Windows Registry. That could make the ransomware more sustainable as it can spread it on more than one place on your computer. Furthermore, the registry entries can make the virus start automatically with every load of the Windows operating system.

There is a ransom note notifying victims that their computer devices have been infected with the ransomware and the note is written in the Bengali language (targeting people from India and Bangladesh). You can preview the screen with the ransom note below:

stf-masterbuster-ransomware-master-buster-virus-darkwing-ransom-note-message-bengali-language-bangladesh-victims

There is also a ransom message in the file READ_THIS_FILE_IMPORTANT.txt which reads the following:

IMPORTANT!!!!

Apnar Computer er shokol gurottopurno file encrypt kora hoyeche.
KONO FILE TOUCH KORBEN NA!
Amra shokol file recover kore dibo.

Jebhabe apnar file recover korben: –
1) Ei link e jan:- http://goo.gl/forms/vftoBRppkJ

2) Form fill-up korun.

3) 24 hours er moddhe apnar email + mobile SMS a shokol dhoroner instructions chole jabe.

Thank you!

DarkWing020

Here is how that text looks in the document:

stf-masterbuster-ransomware-master-buster-virus-darkwing-ransom-note-message

A rough translation in English:

IMPORTANT!!!!

The files on your computer were encrypted securely.
DO NOT DELETE THE FILES!
We can recover your files using a decoder.

To obtain a decoder you must do the following steps:
1) Open the link:- http://goo.gl/forms/vftoBRppkJ

2) Fill up the form.

3) Wait 24 hours to confirm payment via email + SMS and follow the instructions sent to you

Thank you!

DarkWing020

You are given a deadline of 10 days to pay the sum of 3,500 Indian Rupees. In case you surpass that period, your sum will increase to 5,000 or 10,000 rupees. In the worst case scenario – you will need to pay an equivalent of 150 US dollars. However, you should NOT even be thinking of contacting the cybercriminals or supporting their criminal activity financially. No one can guarantee that your files will become accessible after paying. What’s more, the criminals will probably use the money for making new ransomware.

The MasterBuster ransomware encrypts files and appends the .hcked extension to them. Here you can see a list with file extensions which the ransomware searches to encrypt:

.3dm, .3ds, .3gp, .7z, .accdb, .apk, .app, .asp, .aspx, .avi, .bat, .bin, .bmp, .css, .csv, .dmg, .doc, .docx, .dwg, .dxf, .fla, .flac, .flv, .gem, .html, .ipa, .iso, .jar, .jpeg, .jpg, .js, .m4a, .mdb, .mdf, .mov, .mp3, .mp4, .mpeg, .mpg, .odt, .ogg, .pdf, .php, .png, .pps, .ppt, .pptx, .psd, .py, .rar, .rom, .rtf, .sav, .sln, .sql, .swf, .swift, .txt, .vb, .wav, .wmv, .xls, .xlsx, .xml, .zip

It encrypts files in the following locations:

  • %DriveLetter%
  • %SystemDrive%\users\public
  • %UserProfile%\Documents
  • %UserProfile%\Downloads
  • %UserProfile%\Desktop

The MasterBuster cryptovirus is more than likely to erase the Shadow Volume Copies from the Windows operating system by using the following command:

→vssadmin.exe delete shadows /all /Quiet

Read more to see what ways you can implement to try and restore some of your data, even if the restoration is only partial.

Remove MasterBuster and Restore .hcked Files

If your computer got infected with the MasterBuster ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by MasterBuster.

Manually delete MasterBuster from your computer

Note! Substantial notification about the MasterBuster threat: Manual removal of MasterBuster requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove MasterBuster files and objects
2.Find malicious files created by MasterBuster on your PC

Automatically remove MasterBuster by downloading an advanced anti-malware program

1. Remove MasterBuster with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by MasterBuster
Optional: Using Alternative Anti-Malware Tools

Berta Bilbao

Berta is the Editor-in-Chief of SensorsTechForum. She is a dedicated malware researcher, dreaming for a more secure cyber space.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.