.Locked Virus (Ultimo Ransomware) - Remove + Restore Files

.Locked Virus (Ultimo Ransomware) – Remove + Restore Files

READ_IT.txt .locked Ultimo ransomware virus removal guide sensorstechforum

The .locked virus is categorized as a data locker ransomware that belongs to the HiddenTear family. The threat is also dubbed Ultimo ransomware by security researchers. It is designed to utilize the strong cipher algorithm AES for encryption of valuable data stored on the infected host. The extension .locked could be seen at the end of all corrupted files which remain unusable until victims pay the ransom of 0.022 BTC to hackers.

This article reveals more details about .locked file virus (Ultimo ransomware) and provides easy-to-follow ransomware removal instructions. By following the steps, users can prevent ransom payment and recover .locked files with the help of alternative data recovery methods.

Threat Summary

Name.Locked Virus
Short DescriptionThe ransomware encrypts files on your computer and displays a ransom message afterward.
SymptomsThe ransomware will encrypt your files and put the extension .locked to them after it finishes its encryption process.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by .Locked Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .Locked Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.Locked File Virus – Infection Spread

The .locked virus infection can be triggered by a single file that just needs to be started on the system. This file is usually embedded email attachment that is presented as a legitimate important document. Cyber criminals carefully craft the message to make users more prone to download and open the attachment on the PC. The .locked virus may also be distributed via corrupted web links. The web pages contain the malicious ransomware payload and are set to auto download it once you land on them. Such links can be again part of spam email campaigns or send via social media channels or displayed as online advertisements.

.Locked File Virus – Detailed Overview

The attack is triggered by Weaternunion MTCN.exe file after it is started on the PC. The .locked file virus aims to ensure its persistent presence on the system so it creates new malicious values in the Windows Registry. The threat is likely to attack Run and RunOnce registry keys that control the execution of all Windows startup processes. By creating new values in these keys the ransomware set the automatic execution of all malicious files on each Windows start. Some of registry modifications are connected with a file called READ_IT.txt. The .locked file virus (Ultimo ransomware) drops the file on the Desktop and displays it automatically by setting values in the keys mentioned above. Once the file that appears on the screen shows the following ransom message to victims:

Oooopppsss Your Files Has Been Encrypted
Your Unique GUID for Decrypt: j43as8fk-29gp-61da-3671-h03c83472r74
SEND ME SOME 0.022 Bitcoin on Adress: 1CCnFhbLT1VSMUqXaSqsYUAwcGU4evkbJo
After Confirming The Payment, ALL YOUR FILES CAN BE DECRYPTED.
If you do not make payment within 48 Hrs, you will lose the ability to decrypt them.
Make your Bitcoin Wallet on: xxxxs://www.coinbase.com/ or xxxx://blockchain.info”.
How to buy /sell and send Bitcoin :
After the payment, enter the wallet from which paid, and email, in which contact you. [email protected]”,
After receiving the payment, we will contact you.

The message aims to blackmail victims into paying the ransom as soon as possible by setting 48 hours dead line. However, it is better not to trust cyber criminals that making the payment will potentially decrypt .locked files. There is always a chance that the ransomware code is broken and doesn’t generate working decryption keys. Furthermore, cyber criminals may not contact victims after ransom payment.

.Locked Virus – Encryption Process

As .locked file virus is a HiddenTear variant it could be programmed to encrypt files with the following file extensions:

→.txt, .doc, .docx, .xls, .xlsx, .pdf, .pps, .ppt, .pptx, .odt, .gif, .jpg, .png, .db, .csv, .sql, .mdb.sln.php, .asp, .aspx, .html, .xml, .psd, .frm, .myd, .myi, .dbf, .mp3, .mp4, .avi, .mov, .mpg, .rm, .wmv, .m4a, .mpa, .wav, .sav, .gam, .log, .ged, .msg, .myo, .tax, .ynab, .ifx, .ofx, .qfx, .qif, .qdf, .tax2013, .tax2014, .tax2015, .box, .ncf, .nsf, .ntf, .lwp

Being based on HiddenTear open-source ransomware project, .locked file virus is utilizing the AES cipheralogorithm to modify the original code of target files. Each encrypted file will receive an extension appended to it, which is .locked.

Furthermore, the ransomware may erase all the Shadow Volume Copies from the Windows operating system with the help of the following command:

→vssadmin.exe delete shadows /all /Quiet

The command makes the encryption process more efficient as it will eliminate one of the ways for restoring .locked files.

Remove .Locked File Virus and Restore Data

The .locked file virus (Ultimo ransomware) should be removed as soon as possible from the infected computer because it endangers private files and the overall system security. Beware that it has a complex code that modifies various system settings and processes so some malicious files may remain well hidden. For the best removal results, security experts recommend the assistance of professional anti-malware tool.

Gergana Ivanova

Gergana Ivanova

Gergana has completed a bachelor degree in Marketing from the University of National and World Economy. She has been with the STF team for three years, researching malware and reporting on the latest infections.

More Posts

Follow Me:
Google Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share