The malware researcher Karsten Hahn has discovered the MasterBuster ransomware. The virus will encrypt your files with the .hcked extension and display a ransom note with payment instructions afterward. The ransomware is based on the open-source EDA2 project. To see how to remove the ransomware and how you can try to restore your files, read the article in full.
|Short Description||The ransomware will encrypt your files and then display a ransom note with payment instructions.|
|Symptoms||All encrypted files get the extension .hcked appended to them.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by MasterBuster |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss MasterBuster.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
MasterBuster Virus – How Does It Infect?
The MasterBuster ransomware might get inside your computer machine by using multiple ways. The payload file could be spread via spam e-mails. The spam mail tactic is designed to make you think that the email and its attached file are important. If you fall for that, you might open the attachment. Then, the malicious content from the file releases the payload and your computer becomes infected. You can see an example of a payload file and its detections from malware vendors on the VirusTotal website right here:
MasterBuster ransomware might infect your PC using different methods. For example, the malware creators could distribute the malware file via social media and file-sharing platforms. The file could be presented as a useful or needed application. Refrain from just opening files from unknown sources, especially if they come in the form of e-mails or a link you know nothing about. First, you should do a scan with a security tool and check the size and signatures of the file. You should read the ransomware prevention tips from the thread in the forum section.
MasterBuster Virus – What Does It Do?
The MasterBuster ransomware is a cryptovirus that is targeting users from Bangladesh and India. The malware researcher Karsten Hahn from G Data has found a malware sample in the wild. The ransomware is written on the open-source EDA2 (Hidden Tear) project.
Your files will get encrypted and afterward the extension .hcked will be appended to every one of them. The instructions with demands are written in two different files, one of which launches as a screen on your desktop.
MasterBuster connects to the following remote locations:
Information such as your computer name, user name, password and the current date can be sent to those two locations.
When the MasterBuster ransomware launches its payload, it can create entries in the Windows Registry. That could make the ransomware more sustainable as it can spread it on more than one place on your computer. Furthermore, the registry entries can make the virus start automatically with every load of the Windows operating system.
There is a ransom note notifying victims that their computer devices have been infected with the ransomware and the note is written in the Bengali language (targeting people from India and Bangladesh). You can preview the screen with the ransom note below:
There is also a ransom message in the file READ_THIS_FILE_IMPORTANT.txt which reads the following:
Apnar Computer er shokol gurottopurno file encrypt kora hoyeche.
KONO FILE TOUCH KORBEN NA!
Amra shokol file recover kore dibo.
Jebhabe apnar file recover korben: –
1) Ei link e jan:- http://goo.gl/forms/vftoBRppkJ
2) Form fill-up korun.
3) 24 hours er moddhe apnar email + mobile SMS a shokol dhoroner instructions chole jabe.
Here is how that text looks in the document:
A rough translation in English:
The files on your computer were encrypted securely.
DO NOT DELETE THE FILES!
We can recover your files using a decoder.
To obtain a decoder you must do the following steps:
1) Open the link:- http://goo.gl/forms/vftoBRppkJ
2) Fill up the form.
3) Wait 24 hours to confirm payment via email + SMS and follow the instructions sent to you
You are given a deadline of 10 days to pay the sum of 3,500 Indian Rupees. In case you surpass that period, your sum will increase to 5,000 or 10,000 rupees. In the worst case scenario – you will need to pay an equivalent of 150 US dollars. However, you should NOT even be thinking of contacting the cybercriminals or supporting their criminal activity financially. No one can guarantee that your files will become accessible after paying. What’s more, the criminals will probably use the money for making new ransomware.
The MasterBuster ransomware encrypts files and appends the .hcked extension to them. Here you can see a list with file extensions which the ransomware searches to encrypt:
.3dm, .3ds, .3gp, .7z, .accdb, .apk, .app, .asp, .aspx, .avi, .bat, .bin, .bmp, .css, .csv, .dmg, .doc, .docx, .dwg, .dxf, .fla, .flac, .flv, .gem, .html, .ipa, .iso, .jar, .jpeg, .jpg, .js, .m4a, .mdb, .mdf, .mov, .mp3, .mp4, .mpeg, .mpg, .odt, .ogg, .pdf, .php, .png, .pps, .ppt, .pptx, .psd, .py, .rar, .rom, .rtf, .sav, .sln, .sql, .swf, .swift, .txt, .vb, .wav, .wmv, .xls, .xlsx, .xml, .zip
It encrypts files in the following locations:
The MasterBuster cryptovirus is more than likely to erase the Shadow Volume Copies from the Windows operating system by using the following command:
→vssadmin.exe delete shadows /all /Quiet
Read more to see what ways you can implement to try and restore some of your data, even if the restoration is only partial.
Remove MasterBuster and Restore .hcked Files
If your computer got infected with the MasterBuster ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by MasterBuster.