Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


SecureCryptor Ransomware – Remove It and Restore .SecureCrypted Files

secure-cryptor-main-sensorstechforumAnother ransomware has started attacking users, encoding their important documents with a strong cipher. Its name is SecureCryptor, and it can be recognized by its distinctive file extension -.SecureCrypted. SecureCryptor ransomware uses a powerful encryption to cipher files of users, scrambling their hex code. This is done with the purpose of getting the user to make a ransom payoff on the email recoveryhelp@bk.ru to gain access back to the files. Users are strongly advised not to pay any ransom money to cyber-criminals since it is no guarantee of getting the files back.

Threat Summary

Name SecureCryptor
Type Ransomware
Short Description Encrypts the user’s files with a strong encryption algorithm and requests to contact e-mail address to make a ransom payoff, most likely in BitCoin.
Symptoms Files are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows when you try to open an encrypted file.
Distribution Method Spam Emails, Email Attachments, File Sharing Networks.
Detection Tool See If Your System Has Been Affected by SecureCryptor

Download

Malware Removal Tool

User Experience Join our forum to Discuss Locky Ransomware.

SecureCryptor Ransomware – Distribution

To be spread and infect users, SecureCryptor may use a combination methods, such as malicious URLs, spam email messages, malicious Microsoft Office/Adobe Macros, JavaScript, Exploit Kits, Browser Redirecting URLs. An example of a spam e-mail message which may be originating by SecureCryptor may be the following:

spam-email-sensorstechforum

SecureCryptor Ransomware Viewed In Details

Once activated on the user’s computer, the ransomware may drop one or more malicious scripts in the form of files that may have different names. The usual targeted folders and filenames by ransomware viruses like SecureCryptor are the following:

commonly-used-file-names-and-folders

SecureCryptor Ransomware virus may delete volume shadow copies and other backups of files in Windows, by executing a script with escalated privileges and the following Windows command:

→ vssadmin delete-shadows /all /quiet

Then, the SecureCryptor ransomware may scan for and encrypt files of the following file types:

→ “PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”Source:fileinfo.com

After encryption, the hex code of the files is scrambled, and they are no longer accessible. The extension .SecureCrypted is added, for example:

→ New Text Document.txt.SecureCrypted.Contact_Here_To_Recover_Your_Files.txt

When the file is opened, the following message can be seen:

“A L L Y O U R F I L E S A R E E N C R Y P T E D
All your data – documents, photos, videos, backups – everything is encrypted.
The only way to recover your files: contact us to the next email: recoveryhelp@bk.ru
Attach to e-mail:
1. Text with your IP server as Subject (To locate your encryption algorithm)
2. 1-2 encrypted files (please don’t send files bigger than 1 MB)
We will check the encrypted file and send you an email with your decrypted file as proof that we actually have the decrypter software.
Remember:
1. The FASTER you’ll CONTACT US – the FASTER you will RECOVER your files.
2. We will ignore your e-mails without IP server number in Subject.
3. If you haven’t received reply from us in 24 hours – try to contact us via public e-mail services such as Yahoo or so.”

SecureCryptor Ransomware – Conclusion, Removal, and File Reverting

The summary for SecureCryptor is that it is a relatively new variant and uses a strong cipher to encode files. In addition to that, SecureCryptor uses a relatively new technique for such viruses – it attaches a text document opening script to the encrypted files that open directly the ransom note, asking to contact the ransom e-mail for decryption.

To remove the SecureCryptor ransomware virus completely, make sure that you follow the instructions below. They should help you to detect the malicious files manually or assist you with automatically scanning for and detecting virus files and registry entries which might be modified by SecureCryptor.

To try and restore the data, we advise following the instructions in step “3. Restore files encrypted by SecureCryptor.” They may not be 100% effective. However, some users have reported that they were in luck to restore at least a small portion of the files. In addition to that, you may contact the cyber-criminals’ e-mail since they usually offer free decryption of 1 or 2 files as a “guarantee”.

Manually delete SecureCryptor from your computer

Note! Substantial notification about the SecureCryptor threat: Manual removal of SecureCryptor requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove SecureCryptor files and objects
2.Find malicious files created by SecureCryptor on your PC
3.Fix registry entries created by SecureCryptor on your PC

Automatically remove SecureCryptor by downloading an advanced anti-malware program

1. Remove SecureCryptor with SpyHunter Anti-Malware Tool
2. Back up your data to secure it against infections and file encryption by SecureCryptor in the future
3. Restore files encrypted by SecureCryptor
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.