EdgeLocker crypto virus was recently discovered by security researchers, encrypting victims’ files, appending an .edgel extension to each file and demanding 0.1 bitcoin for the decryption key. Once the encryption process via the RSA algorithm is finalized, EdgeLocker displays a ransom message containing instructions on the payment process.
Threat Summary
| Name | EdgeLocker |
| Type | Ransomware |
| Short Description | EdgeLocker encrypts files on the targeted system and appends an .edgel extension to each file. |
| Symptoms | A ransom note is dropped on the victim’s computer. A ransom in the amount of 0.1 Bitcoin is demanded. |
| Distribution Method | Spam emails. |
| Detection Tool | See If Your System Has Been Affected by EdgeLocker Download Malware Removal Tool |
| User Experience | Join our forum to Discuss EdgeLocker. |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
This is what the text on the ransom note reads:
>>> Your files are encrypted by the EdgeLocker ransomware!
>>> Nobody can decrypt your files without a special RSA private key.
>>> YOU can obtain this key by purchasing it for 0.1 Bitcoin from us.
>>> Pay 0.1 BTC on the address 1LVFaPgwCFBnn5BQsSxRmEZ94nKj7tDDVA and then press “Check Payment”
>>> The payment is not recieved instantly; don’t worry.
>>> Key
button “Decrypt”
button “Check Payment”
>>> Warning: do not try to kill this application or the key will be lost!
C:\Users\User\Desktop\test\49.png.edgel
С :\Users\User\Desktop\test\5.doc.edgel
С :\Users\User\Desktop\test\5.jpg.edgel
С :\Users\User\Desktop\test\5.png.edgel
С :\Users\User\Desktop\test\50.doc.edgel
>>> A total of 3905 files encrypted.
EdgeLocker .edgel Virus Technical Resume
Distribution
Researchers have observed ransomware such as EdgeLocker being spread primarily in spam emails containing malicious attachments. However, other possible ways of spreading the crypto virus is through exploit kits, fake updates, and infected freeware installers.
Regarding spam, users should be extra cautious and should never open random emails crafted to look like important messages sent out by legal organizations. This is how cyber criminals are trying to trick you into downloading their malicious payloads.
Details
EdgeLocker demands a ransom in the amount of 0.1 bitcoin. The virus instructs the victim how and where to pay it so that a decryption key is sent. Despite these claims that a decryption key will be send once the payment is finalized, victims should not proceed with paying. For one, ransom payments further enable cyber criminals in continuing and developing their malicious operations.
EdgeLocker drops the following file onto the infected system: _EdgeLocker___.exe. When the file was scanned via VirusTotal on December 31, 2016, only 2 out of the 55 malware engines detected it as malicious:
- Baidu – Win32.Trojan.WisdomEyes.16070401.9500.9988
- Qihoo-360 – HEUR/QVM03.0.0000.Malware.Gen
EdgeLocker .edgel Virus Removal and Decryption Instructions
EdgeLocker file virus, otherwise known as the EdgeLocker ransomware, can be removed manually – the first half of EdgeLocker removal guide below will guide you through the process step by step but don’t forget that at least some experience in malware removal is needed for you to succeed. If you doubt that you can remove the virus yourself, please refer to the instructions for EdgeLocker automatic removal.
As for decryption – for now there is no official decrypter released for EdgeLocker. If you don’t have a back up of your files, you can still attempt restoring them via alternative methods such as data recovery software.
