Hand of God Ransomware Removal – Restore Files

Hand of God Ransomware Removal – Restore Files

This article will help you remove the Hand of God ransomware in full. Follow the ransomware removal instructions provided at the bottom of the article.

Hand of God is the name of a ransomware virus. The virus is a screenlocker type and pretends to have a message from the FBI. It states that you have been involved with illegal activity and must pay a fine. Do not pay as that is a scare tactic, trying to persuade you to do so. Hand of God may not encrypt your files but still open a window, displaying the ransom payment instructions. These instructions demand that you pay 555 US dollars to the cybercriminals in Bitcoin cryptocurrency. Read on below and find out what ways you could try to potentially recover some of your files.

Threat Summary

NameHand of God
Short DescriptionThe ransomware is not reported to encrypt files and is of the screenlocker type. No matter if it encrypts or not now, it will still show a ransom note if you get infected.
SymptomsThis ransomware virus demands you to pay the sum of 555 US dollars as ransom in the form of Bitcoin to the cybercriminals stating that your files are encrypted.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Hand of God


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Hand of God.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Hand of God Ransomware – Delivery

Hand of God ransomware could be delivered in more than one way. However, the way that is the most widespread is via a payload dropper file which initiates the malicious script for the ransomware. A sample has been spotted by malware researchers and you can preview its analysis available on the VirusTotal service from down below:

The Hand of God ransomware might be using other ways to deliver the payload file, such as social media and file-sharing sites. Freeware applications found on the Internet could be promoted as helpful but also could hide the malicious script for this virus. Before opening any files after you have downloaded them, you should instead scan them with a security program. Especially if they come from suspicious places, such as emails or links. Also, don’t forget to check the size and signatures of such files for anything that seems out of place. You should read the ransomware prevention tips given in the forum.

Hand of God Ransomware – Details

The Hand of God ransomware is a virus, which has been recently discovered by malware researchers. Although the virus is of the screenlocker variety, it will still show a ransom note demanding payment. Hand of God ransomware will pop up a window that serves as a ransom note with instructions that is actually a screen locking your computer and blocking access.

In the future, the Hand of God ransomware could be set to make new registry entries in the Windows Registry to achieve a higher level of persistence. Those entries are usually designed in a way that will start the virus automatically with every launch of the Windows Operating System, like in the example given below:


The ransom message will load up as a screenlocking image and it can be seen right here below:

The message states the following:

Sortie de Secours

V0TR3 M4CH1N3 35T M41NT3N4NT INN4CE55I813

ATTENTION You Have Been Hacked !!!

Cet Ordinateur et toutes ses données importantes ont été véroufllé
La Main de Dieu vous puni pour avoir escroqué des chercheurs d’emploi
en leurs promettant un emploi au Canada pour le poste de téléopérateur…
Toutes tentatives de désactivation ultérieures a ce programme échouerons
Vos fonctions systèmes ont été désactivées
Ce Programme est concu pour s‘auto-détruire dans 2 jours en entraînant la
Suppression complete de tous vos fichiers

Comment Désactiver Ce Virus

Vous devez payer le montant de 0.06 Bitcoin (ETC) = 555.29 Dollar (CAD)
à l‘adresse bitcoin suivante : 1Emhk1iJhcVTxPEWu4vqwPyUjXqz33So3F

Moyens de payement

Vous disposez de plusieurs moyens de payement qui consistent
a acheter ou a transferer des bitcoins à l‘adresse indiquée plus haut
Veuillez visiter le site suivant : https://cryptogains.fr/229-comment-acheter-des-bitcoins

A rough English translation will look like this:

Emergency exit


ATTENTION You Have Been Hacked !!!

This Computer and all its important data have been gobbled
The Hand of God punishes you for cheating job seekers
promising them a job in Canada for the teleoperator position …
Any subsequent disabling attempts to this program will fail
Your system functions have been disabled
This program is designed to self-destruct in 2 days by executing the
complete deletion of all your files

How to Disable This Virus

You must pay the amount of 0.06 Bitcoin (ETC) = 555.29 Dollar (CAD)
at the following bitcoin address: 1Emhk1iJhcVTxPEWu4vqwPyUjXqz33So3F

Means of payment

You have several means of payment which consist
of buying or transferring bitcoins to the address indicated above
Please visit the following site: https://cryptogains.fr/229-how-to-purchase-bitcoins

The ransom sum that is demanded as payment for allegedly restoring access to your computer device is 555 US dollars. As the virus doesn’t necessarily lock your files themselves but just the access to them, it is probably removable. You should NOT in any case consider paying these cybercriminals. By paying, you can motivate them to do similar criminal acts in the future, which is strongly advised against.

Hand of God Ransomware – Encryption

There is no official list with file extensions that the Hand of God ransomware seeks to encrypt and the article will be updated if there are changes regarding the matter. The virus might still be in-development. However, the files used most by users and which are probably going to get encrypted are from the following list of categories:

  • Document files
  • Audio files
  • Video files
  • Image files
  • Backup files
  • Banking credentials and data

The Hand of God cryptovirus is more than likely to erase the Shadow Volume Copies from the Windows Operating System by executing the following command:

→vssadmin.exe delete shadows /all /Quiet

If the above-stated command is inputted into the command prompt of the Windows operating system, that will make the encryption process more effective, as one of the main ways for file recovery will be gone. Continue reading to find out what methods you can try out to potentially restore some of your files.

Remove Hand of God Ransomware and Restore Files

If your computer got infected with the Hand of God ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.


Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share