New ransomware variant, whose name was chosen by its creators to be “Apocalypse” has emerged out into the open. The ransomware also known as a crypto-virus uses either RSA or AES cipher to encrypt the files of the computers it infects and runs on startup pretending to be a Windows Update process. Since this ransomware virus demands different ransom payoff ammount in BitCoin, users infected with it are strongly advised not to pay any. Instead it is recommended to follow the instructions here to remove Apocalypse and decrypt your data, using the Decryptor posted below.
Apocalypse Ransomware Decryptor Variant 1
Apocalypse Ransomware Decryptor Variant 2
Threat Summary
| Name | Apocalypse |
| Type | Ransomware |
| Short Description | The ransomware encrypts files with a strong cipher and asks a ransom payoff for decryption by contacting its e-mail. |
| Symptoms | Files are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows as a How_To_Decrypt.txt file. |
| Distribution Method | Spam Emails, Email Attachments, File Sharing Networks. |
| Detection Tool | See If Your System Has Been Affected by Apocalypse Download Malware Removal Tool |
| User Experience | Join our forum to Discuss Apocalypse Ransomware. |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
Apocalypse Ransomware – Ways of Spreading
In order to be successfully redistributed out into the open, Apocalypse uses different techniques. One of those is posting malicious web links on various places througout the web. Such web links may be featured in spam e-mails resembling a big company, like a bank or PayPal.
Another method of spreading this ransomware may be via potentially unwanted programs (PUPs) which are also known to cause browser redirects.
Apocalypse crypto-virus may also be featured as a malicious e-mail attachment in spam message sent via e-mail.
Apocalypse Ransomware – Methods of Operation
Once activated on your computer, the dropper of the ransomware virus creates an executable in the following Windows directory:
C:\Program Files (x86)\windowsupdate.exe,/p>
After doing so, Apocalypse modifies the registry entry of the infected computer so that this executable runs when you start your Windows OS. This is possible by adding values in the following registry key:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Svc C:\Program Files (x86)\windowsupdate.exe
On system startup, the ransomware may run as a Windows Update service and block the user, explaining to him that the files are encrypted. It may also run in an obfuscated manner to avoid detection by anti Anti-Virus programs.
To encrypt the files, the Apocalypse ransomware uses an exclusion list. Basically, it encodes every single file of the infected computer except files with the following file extensions:
.encrypted, .dat, .bat, .bin, .ini, .tmp, .lnk, .com, .msi, .sys, .dll, .exe
After enciphering the data, Apocalypse ransomware adds the .encrypted extension to the files, for example:
Picture.jpg.enrypted.How_To_Decrypt.txt
The ransomware also drives users to open the “How_To_Decrypt.txt” file which states the following ransom note:
IF YOU ARE READING THIS MESSAGE, ALL THE FILES IN THIS COMPUTER HAVE BEEN CRYPTED!!!
documents,pictures,videos,audio,backups,etc
IF YOU WANT TO RECOVER YOUR DATA, CONTACT THE EMAIL BELOW
EMAIL: [email protected]
WE WILL PROVIDE DECRYPTION SOFTWARE TO RECOVER YOUR FILES.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF YOU DONT CONTACT BEFORE 72 HOURS, ALL DATA WILL BE LOST FOREVER”
After the encryption process has finished, the ransomware locks the user out of his computer and the only way to access the system again is in Safe Mode.
Remove Apocalypse Ransomware and Decrypt Your Files
To fully erase this ransomware from your computer, we strongly advise following our instructions below. In addition to that experts also recommend removing its malicious files and objects using an advanced-anti-malware tool for maximum effectiveness.
To decrypt your files it is advisable to download EmsiSoft`s decrypter for Apocalypse Ransomware below:
EmsiSoft Decrypter for Apocalypse Ransomware
