Hey you,

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:

Remove Redshitline@india.com Ransomware and Restore .Xtbl Encrypted Files

A new ransomware, carrying the vulgar name of its ransom email address, redshitline@india.com has been reported to be massively spread. It encrypts the user files with a strong cypher and uses the ransom email plus a .xtbl file extension after it. The questionable malware is believed by security experts to be a part of RaaS (Ransomware as a service) operation because it has many variants.

Threat Summary



Type Ransomware
Short Description Part of the “@” ransomware variants. Encrypts the files on the infected computer then asks for ransom money in email correspondences.
Symptoms The user may witness his files to become corrupt with the questionable email and .xtbl as file extensions that are added.
Distribution Method Via Exploit kits or downloader Trojans.
Detection Tool See If Your System Has Been Affected by Redshitline@india.com


Malware Removal Tool

User Experience Join our forum to Discuss Redshitline@india.com Ransomware.

Redshitline@india.com – How Did I Get It

The most likely method that the Redshitline@india.com crypto-malware may have used to spread onto the user PCs may be via two main methods:

  • Malicious URLs posted as spam comments on forums or other social websites.
  • Malicious URLs featured in spam emails may resemble like they are originating from a legitimate service.

Either way, the Redshitline@india.com ransomwar may also not come directly onto the computer, but arrive via other malware. The most often used malware to download crypto-viruses are MSIL Trojans and Exploit Kits, such as the Angler Exploit Kit. Since their executables are obfuscated by the so-called cryptors or obfuscating software, it is difficult for a conventional antivirus software to detect them. The distribution malware may either open a port, connect to a host and download the malicious .exe via the port or directly create an exploit for the attackers.

Redshitline@india.com Ransomware In Detail

Similar to other variants, like helpme@freespeechmail.com or file2@openmailbox.org this variant may drop its payload in several locations:

  • %UserProfile%
  • %Roaming%
  • %AppData%

The files dropped may be of the following file types:

→ .exe, .dll, .tmp

Each one of the modules of this ransomware may have different function. The malware then may set a registry key to run on system startup after which look for the most commonly used file types and encrypt them.

An encrypted file by the Redshitline@india.com ransomware looks as follows:

→ Picture.jpg.redshitline@india.com.xtbl

The Redshitline@india.com virus then may change the wallpaper of the user to a wallpaper that asks the user to contact the questionable e-mail for further instructions. Here is what the wallpaper states:

Important files on this PC are locked
If you want to reset this operation send one locked file to this email:
Important information: You only have 3 days to reply to this email before unlocking becomes impossible.”

The Redshitline@india.com ransomware also has a text file, named “How to decrypt your files.txt”. Judging by what type it is this ransomware is most likely sold on the dark web as a service for cyber-criminals who do not have the experience to program their own Redshitline@india.com ransomware. This is why all of the “@” types of ransomware use a specific contact email address that is unique to them and different wallpaper. However, they may be very similar in their structure.

Remove Redshitline Ransomware and Restore .Xtbl Files

In order to delete this ransomware, it is strongly advisable to use an advanced anti-malware software. Furthermore, we strongly recommend using the advanced anti-malware software because it will remove the ransomware and other malware that be executed on your computer without damaging your files.

Regarding file restoration, we recommend using the methods outlined in Step “4” from the instruction below.

Manually delete Redshitline@india.com from your computer

Note! Substantial notification about the Redshitline@india.com threat: Manual removal of Redshitline@india.com requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Redshitline@india.com files and objects
2. Find malicious files created by Redshitline@india.com on your PC
3. Fix registry entries created by Redshitline@india.com on your PC

Automatically remove Redshitline@india.com by downloading an advanced anti-malware program

1. Remove Redshitline@india.com with SpyHunter Anti-Malware Tool
2. Back up your data to secure it against infections and file encryption by Redshitline@india.com in the future
3. Restore files encrypted by Redshitline@india.com
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

  • Brian Lakstins

    I have a customer with this virus. It started encrypting network shares on March 21st.

    The system infected is a virtual machine, so it is now shutdown without being cleaned.

    I tried Kaspersky Rakhni Decryptor and Rannoh Decryptor, but with no luck. Rakhni Decryptor gives an unsupported file type error. Rannoh Decryptor gives an error Can’t initialize on pair followed by Can’t init decryptor.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.