A lot has happened since we released the previous part with ransomware decryption instructions. Many viruses which were initially thought to be impenetrable have been decoded and brought new hope for those who do not want to pay money to…
A ransomware cryptovirus called KillerLocker was recently discovered in the wild. The ransom note it shows is written in Portuguese and gives 48 hours for victims to contact the cybercriminals. The virus states in its ransom message that it uses…
JokeFromMars, also known as MarsJoke ransomware uses AES cipher to encrypt files, adding the .a19 and .ap19 file extension to them. The ransomware virus demands 0.7 or 1.1 BTC (depending on it’s variant) payment to cyber-criminals. The good news is…
A new ransomware virus spreads through the Remote Desktop Protocol (RDP) found on many computer systems. Its real name is Xpan, but many victims and some researchers refer to it as TeamXRat ransomware. The name TeamXRat comes from the cybercriminals…
Ransomware infection, calling itself CryptoLockerEU 2016 uses the “.send 0.3 BTC crypt” file extension which it adds to files it encrypts on infected computers. This is the first case we’ve seen where the ransom money demanded are included in the…
This is an instructive article to help you remove Cerber README.hta Ransomware and restore encrypted files. Cerber ransomware virus has appeared out into the wild in a new variant using a README.hta file, according to malware researcher Michael Gillespie. What…
This article is created to help remove Globe Ransomware v1, v2 and v3 .WormKiller@india.com.xtbl and .[pingy@india.com] and decrypt files. Two very devastating ransomware variants of the famous JigSaw ransomware which was released as a service online have been successfully decrypted.…
Nuke ransomware virus is here and it aims to nuke any chance it’s victims have of seeing their files again, by encrypting them with a strong AES-256 bit cipher. The ransomware demands from affected users to contact the criminals at…
Ransomware virus that has been specifically designed to attack systems running OS’s for servers, like the Windows Server 2012 has been detected to cause infections and encrypt files on compromised server. ESG malware researchers have reported that this may be…
New version of the Razy ransomware virus, known by the name Krypte has been released and has begun encrypting files with what appears to be an AES cipher. The virus has been created exclusively for German users. The virus aims…
Princess Locker virus has recently been discovered by the malware researcher Michael Gillespie. The virus looks very much alike the Alma Locker ransomware. The methods of infection are still unknown, but since this could be a variant of Alma, the…
Locky ransomware continues to evolve. The new extension .ODIN is placed as an appendix to the original file extension names after they get encrypted. The cryptovirus seeks to encrypt nearly 400 different file types. As the ransom note states, data…
Virlock ransomware has apparently been updated and is now capable of propagating itself via the cloud. Hence, the ransomware can be spread negligently from one infected to another, eventually file-locking an entire network. This update seen in the code of…
New variant of the Samas ransomware has been reported to demand the sum of 1.7 bitcoins after it uses RSA encryption to encipher files of infected computers, adding the .iloveworld file extension to them. The ransomware then drops a PLEASE_READ_FOR_DECRYPT_FILES_{number}.html…
Locky ransomware is back with a new variant. This time, it encrypts files by adding the extension .ODIN to every file that ends up being locked in the process. The ransom note says that the encryption which is used is…
Also known as MarsJoke ransomware, this malware is everything but a joke. It uses a strong AES-256 encryption algorithm to encode the files of an infected computer. The virus is deemed to be widespread and very dangerous, primarily because of…
A new cryptovirus is on the loose. Discovered by the malware researcher Michael Gillespie, it is observed that it is themed around the Harry Potter novels. The ransomware uses a file named “voldemort.horcrux”, thus it is dubbed Voldemort ransomware. The…
A ransomware crypto-virus that goes by the name of MotoxLocker was discovered by researchers from the MalwareHunterTeam. They claim that the virus is a new variant of the DetoxCrypto ransomware and that it uses the AES algorithm for encryption. Locked…
New ransomware virus, named UnblockUPC has been detected by malware researchers to encrypt files with AES-128 encryption and ask 0.18 BitCoins as ransom money. The virus infects computers via different methods, such as e-mail spam after which uses the abovementioned…
A vbs-script using ransomware virus, named Cyber SpLiTTer has been created to ask 1 BTC from users that have been infected by it. What is interesting about this virus is that it was created by the Cerber model since just…
