A new ransomware from the “@” variants has been spotted and reported out in the wild. It carries the name PayCrypt and locks user files appending a random identification file extension with the paycrypt@aol e-mail address. The encrypted files are rendered corrupt, and affected users’ only viable choice seems to be following the ransom instructions which the virus sets as wallpaper. They include contacting the e-mail address and negotiating the ransom payment. We strongly advise affected users not to pay the ransom and to seek alternative file decryption methods.
|Short Description||Encrypts your files demanding ransom payment for their decryption.|
|Symptoms||The user may witness the wallpaper changed to the one posted below and his files to have a custom extension and become DOS type of files.|
|Distribution Method||Via malicious files, Exploit Kits or malicious URLs.|
|Detection Tool||Download Malware Removal Tool, to See If Your System Has Been Affected by PayCrypt|
|User Experience||Join our forum to discuss PayCrypt.|
PayCrypt Ransomware – Spread
To be redistributed over the web, the crypto-malware may use various methods. Since the infected file dropped on the victim computers is an executable with a random alpha numerical name, experts would suggest that it was copied to the computer via several different distribution methods:
- As an attachment via a spam email message.
- As a file that has been dropped via an exploit kit.
- A drive-by download of a Dropper caused by visiting a malicious link.
Users are strongly advised always to check unfamiliar files and links using their antivirus or services such as VirusTotal.
PayCrypt Ransomware In Detail
Once the “@” ransomware has been activated on the user’s PC, it may create files several files in key folders:
After doing so, the ransomware may seek to encrypt files that are commonly used (http://fileinfo.com/filetypes/common) on the user PC. An encrypted file looks like the following example:
- New Text Document.email@example.com
The files are encrypted with a randomly generated numerical number after which the firstname.lastname@example.org address. After encrypting the user’s data, this particular ransomware also uses a ransom message which points out the PayCrypt e-mail address. The ransom message may be the following:
Some users who contacted ransomware such as this one have reported establishing contact with the cyber-criminals and even lower down the ransom money. However, we at SensorsTechForum strongly advise against paying any ransom money at all for several different reasons:
- You fund the cyber-criminals to improve their malware and spread it even more.
- There is no guarantee you will get your files decrypted by them.
The bottom line for this crypto-malware is that it is most likely sold as a service. This is known as RaaS (Ransomware as a Service) and is very widespread on the deep web markets. Some users have even reported that such malware is being sold in the range 500 to 1000 USD. Just like any other software you may encounter, it may contain instructions on how to be used and ability to set the extension, encryption algorithm (RSA, AES, DH, etc.) and not only this, but the ransomware may also let the user customize the amount of money they will demand.
Remove PayCrypt Ransomware and Restore the Encrypted Files
To remove this crypto-malware, users are strongly advised to follow the step-by-step removal instructions below. They should ensure that you effectively detect and remove the files and other objects like registry entries that are associated with this malware.
After removing the malware, all that is left is for you to get back what is yours – the files. To do this, we have suggested several removal methods in step “4. Restore Files Encrypted by PayCrypt” below. One of those methods is Kaspersky’s Rakhni decryptor which has been reported to work with other “@” ransomware variants such as the PayCrypt@aol one. But you should know that the decryption process may take some time, and this is why we recommend setting your computer to stay awake and not hibernate automatically (laptops).
Here is an instruction video on how to remove the malware and try and decrypt your data: