.fmoon Files Virus – Remove MOON DECRYPTOR (+ Restore) - How to, Technology and PC Security Forum | SensorsTechForum.com

.fmoon Files Virus – Remove MOON DECRYPTOR (+ Restore)

This article aims to help you remove the MOON DECRYPTOR ransomware virus from your computer and restore files that have been encrypted with the .fmoon file extension added.

A new ransomware virus, calling itself MOON or MOON DECRYPTOR has been detected by malware researchers to encrypt files on computers it infects, adding the .fmoon file extension. The virus aims to use the AES and RSA ciphers in order to generate unique decryption keys stored in a decrypter for which the user must pay a hefty ransom to receive. If you are one of the victims of MOON DECRYPTOR ransomware, we strongly advise you to read this article and learn how to remove it and get your files back without having to pay anything.

Threat Summary

Name.fmoon Virus
TypeRansomware, Cryptovirus
Short DescriptionVirus from the file encryption kind. Renders your files temporarily useless until you pay a hefty ransom fee to get them back.
SymptomsThe files are no longer openable with an added .fmoon file extension to them. A “decryptor” pops up with instructions how to pay a ransom fee to get the files back.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .fmoon Virus

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .fmoon Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

How Does MOON DECRYPTOR Spread

In order for this ransomware virus to infect unsuspecting users, the cyber-crooks may trick them into opening an infection file or a web link. Such objects may be spread into multiple different methods, the most often used of which is to infect computers via e-mail spam. Such infection process is usually conducted with the classic social engineering technique – deceiving potential victims that they have received an important file, like an invoice, letter of confirmation, bank account statement, hijacked account report or other type of important file. The messages accompanying the file are also deceptive, for example:

Besides via e-mail, this ransomware virus may also be spread via multiple different methods, for instance if it has been uploaded online as a fake setup of software, game patch, crack or any other seemingly legitimate type of program.

MOON DECRYPTOR – Analysis

Once this virus has been activated on your computer system, it may immediately drop it’s malicious files on the user’s computer. As soon as it drops those virus, the ransomware may immediately focus on modifying your computer system, more particularly insert processes in Windows Task Manager, the usage of which may result in MOON DECRYPTOR to obtaind administrative permissions on your computer. The virus may also modify the Windows Registry Editor of the infected computer, more specifically attack the Run and RunOnce registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

In addition to this, MOON DECRYPTOR ransomware may also delete your shadow volume copy backed up files, by using a batch file which it executes without your knowledge. The commands it may insert in the background are the following:

vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures”

In addition to this, the virus also sets a ransom note, named MOON DECRYPTOR which appears like the following:

Image Source: id-ransomware.blogspot.bg

Text from the image:

MOON DECRYPTOR
WHAT HAPPENED ???
Oops all your data are encrypted !!
This is a ransomware AES 256 + RS A 1024!! Look at Wikipedia for morę informations
Please pay before 20 minutes oryour datalll be lost forever. I’ll delete a file per minutę after!
Copy and past this link in Internet Explorer or Firefox :
http://10.10.3.1/panel/decipher.php
and enter your informations :
Your UUID :
Encrypted key iBtSvjYAVWaJslcc4Hn/nMIMrg+bUgA0W4g***
If you obtain your passord, take it here and click on RECOVER
button {RECOVER}

MOON DECRYPTOR – Encryption Process

For the file encryption, MOON ENCRYPTOR uses a strong combination of the following encryption algorithms:

  • AES (Advanced Encryption Standard).
  • RSA (Rivest-Shamir-Adleman).

The AES cipher is used by this virus to encrypt the data in the files themselves. But no all the data of the files is encrypted, only blocks of it. The AES cipher generates decryption keys which are in turn encrypted with the RSA cipher, generating unique private and public keys, that are required for the decryption of the files.

The MOON DECRYPTOR virus targets primarily important files on your computer, such as documents, videos, audio files and other types of files. The file extensions targeted may be most of the following:

→ “PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”Source:fileinfo.com

To the files locked by MOON DECRYPTOR, the file extenson .fmoon is added, making them appear like the example below:

→ New Text Document.txt.fmoon

Remove MOON Ransomware and Restore .fmoon Encrypted Files

In order to remove this ransomware from your computer, we strongly suggest that you focus on backing your files beforehand. After doing so, you can go ahead and follow the instructions for the removal below. They are divided in manual and automatic and for maximum effectiveness, security experts always recommend removing viruses, like MOON automatically using the specific removal software for this purpose.

If you want to restore your files, in the event that they have been encrypted by MOON DECRYPTOR virus, you can go ahead and follow the alternative file recovery methods below in step “2. Restore files encrypted by .fmoon Virus.” They are specifically designed to help you recover as many files as possible without having to pay any form of ransom.

Manually delete .fmoon Virus from your computer

Note! Substantial notification about the .fmoon Virus threat: Manual removal of .fmoon Virus requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove .fmoon Virus files and objects
2.Find malicious files created by .fmoon Virus on your PC

Automatically remove .fmoon Virus by downloading an advanced anti-malware program

1. Remove .fmoon Virus with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by .fmoon Virus
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...