The .locked virus is categorized as a data locker ransomware that belongs to the HiddenTear family. The threat is also dubbed Ultimo ransomware by security researchers. It is designed to utilize the strong cipher algorithm AES for encryption of valuable data stored on the infected host. The extension .locked could be seen at the end of all corrupted files which remain unusable until victims pay the ransom of 0.022 BTC to hackers.
This article reveals more details about .locked file virus (Ultimo ransomware) and provides easy-to-follow ransomware removal instructions. By following the steps, users can prevent ransom payment and recover .locked files with the help of alternative data recovery methods.
|Short Description||The ransomware encrypts files on your computer and displays a ransom message afterward.|
|Symptoms||The ransomware will encrypt your files and put the extension .locked to them after it finishes its encryption process.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by .Locked Virus |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss .Locked Virus.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
.Locked File Virus – Infection Spread
The .locked virus infection can be triggered by a single file that just needs to be started on the system. This file is usually embedded email attachment that is presented as a legitimate important document. Cyber criminals carefully craft the message to make users more prone to download and open the attachment on the PC. The .locked virus may also be distributed via corrupted web links. The web pages contain the malicious ransomware payload and are set to auto download it once you land on them. Such links can be again part of spam email campaigns or send via social media channels or displayed as online advertisements.
.Locked File Virus – Detailed Overview
The attack is triggered by Weaternunion MTCN.exe file after it is started on the PC. The .locked file virus aims to ensure its persistent presence on the system so it creates new malicious values in the Windows Registry. The threat is likely to attack Run and RunOnce registry keys that control the execution of all Windows startup processes. By creating new values in these keys the ransomware set the automatic execution of all malicious files on each Windows start. Some of registry modifications are connected with a file called READ_IT.txt. The .locked file virus (Ultimo ransomware) drops the file on the Desktop and displays it automatically by setting values in the keys mentioned above. Once the file that appears on the screen shows the following ransom message to victims:
Oooopppsss Your Files Has Been Encrypted
Your Unique GUID for Decrypt: j43as8fk-29gp-61da-3671-h03c83472r74
SEND ME SOME 0.022 Bitcoin on Adress: 1CCnFhbLT1VSMUqXaSqsYUAwcGU4evkbJo
After Confirming The Payment, ALL YOUR FILES CAN BE DECRYPTED.
If you do not make payment within 48 Hrs, you will lose the ability to decrypt them.
Make your Bitcoin Wallet on: xxxxs://www.coinbase.com/ or xxxx://blockchain.info”.
How to buy /sell and send Bitcoin :
After the payment, enter the wallet from which paid, and email, in which contact you. [email protected]”,
After receiving the payment, we will contact you.
The message aims to blackmail victims into paying the ransom as soon as possible by setting 48 hours dead line. However, it is better not to trust cyber criminals that making the payment will potentially decrypt .locked files. There is always a chance that the ransomware code is broken and doesn’t generate working decryption keys. Furthermore, cyber criminals may not contact victims after ransom payment.
.Locked Virus – Encryption Process
As .locked file virus is a HiddenTear variant it could be programmed to encrypt files with the following file extensions:
→.txt, .doc, .docx, .xls, .xlsx, .pdf, .pps, .ppt, .pptx, .odt, .gif, .jpg, .png, .db, .csv, .sql, .mdb.sln.php, .asp, .aspx, .html, .xml, .psd, .frm, .myd, .myi, .dbf, .mp3, .mp4, .avi, .mov, .mpg, .rm, .wmv, .m4a, .mpa, .wav, .sav, .gam, .log, .ged, .msg, .myo, .tax, .ynab, .ifx, .ofx, .qfx, .qif, .qdf, .tax2013, .tax2014, .tax2015, .box, .ncf, .nsf, .ntf, .lwp
Being based on HiddenTear open-source ransomware project, .locked file virus is utilizing the AES cipheralogorithm to modify the original code of target files. Each encrypted file will receive an extension appended to it, which is .locked.
Furthermore, the ransomware may erase all the Shadow Volume Copies from the Windows operating system with the help of the following command:
→vssadmin.exe delete shadows /all /Quiet
The command makes the encryption process more efficient as it will eliminate one of the ways for restoring .locked files.
Remove .Locked File Virus and Restore Data
The .locked file virus (Ultimo ransomware) should be removed as soon as possible from the infected computer because it endangers private files and the overall system security. Beware that it has a complex code that modifies various system settings and processes so some malicious files may remain well hidden. For the best removal results, security experts recommend the assistance of professional anti-malware tool.