MasterBuster Virus Removal - Restore .hcked Files - How to, Technology and PC Security Forum |

MasterBuster Virus Removal – Restore .hcked Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)


The malware researcher Karsten Hahn has discovered the MasterBuster ransomware. The virus will encrypt your files with the .hcked extension and display a ransom note with payment instructions afterward. The ransomware is based on the open-source EDA2 project. To see how to remove the ransomware and how you can try to restore your files, read the article in full.

Threat Summary

TypeRansomware, Cryptovirus
Short DescriptionThe ransomware will encrypt your files and then display a ransom note with payment instructions.
SymptomsAll encrypted files get the extension .hcked appended to them.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by MasterBuster


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss MasterBuster.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

MasterBuster Virus – How Does It Infect?

The MasterBuster ransomware might get inside your computer machine by using multiple ways. The payload file could be spread via spam e-mails. The spam mail tactic is designed to make you think that the email and its attached file are important. If you fall for that, you might open the attachment. Then, the malicious content from the file releases the payload and your computer becomes infected. You can see an example of a payload file and its detections from malware vendors on the VirusTotal website right here:


MasterBuster ransomware might infect your PC using different methods. For example, the malware creators could distribute the malware file via social media and file-sharing platforms. The file could be presented as a useful or needed application. Refrain from just opening files from unknown sources, especially if they come in the form of e-mails or a link you know nothing about. First, you should do a scan with a security tool and check the size and signatures of the file. You should read the ransomware prevention tips from the thread in the forum section.

MasterBuster Virus – What Does It Do?

The MasterBuster ransomware is a cryptovirus that is targeting users from Bangladesh and India. The malware researcher Karsten Hahn from G Data has found a malware sample in the wild. The ransomware is written on the open-source EDA2 (Hidden Tear) project.

Your files will get encrypted and afterward the extension .hcked will be appended to every one of them. The instructions with demands are written in two different files, one of which launches as a screen on your desktop.

MasterBuster connects to the following remote locations:


Information such as your computer name, user name, password and the current date can be sent to those two locations.

When the MasterBuster ransomware launches its payload, it can create entries in the Windows Registry. That could make the ransomware more sustainable as it can spread it on more than one place on your computer. Furthermore, the registry entries can make the virus start automatically with every load of the Windows operating system.

There is a ransom note notifying victims that their computer devices have been infected with the ransomware and the note is written in the Bengali language (targeting people from India and Bangladesh). You can preview the screen with the ransom note below:


There is also a ransom message in the file READ_THIS_FILE_IMPORTANT.txt which reads the following:


Apnar Computer er shokol gurottopurno file encrypt kora hoyeche.
Amra shokol file recover kore dibo.

Jebhabe apnar file recover korben: –
1) Ei link e jan:-

2) Form fill-up korun.

3) 24 hours er moddhe apnar email + mobile SMS a shokol dhoroner instructions chole jabe.

Thank you!


Here is how that text looks in the document:


A rough translation in English:


The files on your computer were encrypted securely.
We can recover your files using a decoder.

To obtain a decoder you must do the following steps:
1) Open the link:-

2) Fill up the form.

3) Wait 24 hours to confirm payment via email + SMS and follow the instructions sent to you

Thank you!


You are given a deadline of 10 days to pay the sum of 3,500 Indian Rupees. In case you surpass that period, your sum will increase to 5,000 or 10,000 rupees. In the worst case scenario – you will need to pay an equivalent of 150 US dollars. However, you should NOT even be thinking of contacting the cybercriminals or supporting their criminal activity financially. No one can guarantee that your files will become accessible after paying. What’s more, the criminals will probably use the money for making new ransomware.

The MasterBuster ransomware encrypts files and appends the .hcked extension to them. Here you can see a list with file extensions which the ransomware searches to encrypt:

.3dm, .3ds, .3gp, .7z, .accdb, .apk, .app, .asp, .aspx, .avi, .bat, .bin, .bmp, .css, .csv, .dmg, .doc, .docx, .dwg, .dxf, .fla, .flac, .flv, .gem, .html, .ipa, .iso, .jar, .jpeg, .jpg, .js, .m4a, .mdb, .mdf, .mov, .mp3, .mp4, .mpeg, .mpg, .odt, .ogg, .pdf, .php, .png, .pps, .ppt, .pptx, .psd, .py, .rar, .rom, .rtf, .sav, .sln, .sql, .swf, .swift, .txt, .vb, .wav, .wmv, .xls, .xlsx, .xml, .zip

It encrypts files in the following locations:

  • %DriveLetter%
  • %SystemDrive%\users\public
  • %UserProfile%\Documents
  • %UserProfile%\Downloads
  • %UserProfile%\Desktop

The MasterBuster cryptovirus is more than likely to erase the Shadow Volume Copies from the Windows operating system by using the following command:

→vssadmin.exe delete shadows /all /Quiet

Read more to see what ways you can implement to try and restore some of your data, even if the restoration is only partial.

Remove MasterBuster and Restore .hcked Files

If your computer got infected with the MasterBuster ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by MasterBuster.


Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share