Coin Locker, also Coin Locker malware or CoinLocker, is a new piece of ransomware that once active on the compromised machine, scans the system and encrypts certain files, leaving the user unable to open them. As a typical ransomware infection, Coin Locker displays a message demanding a fee in exchange for the decryption key needed to restore the affected files.
Coin Locker – Technical Details
The Coin Locker ransomware uses Ceasar Cipher to block the files on the targeted computer. This particular method switches characters in a particular order, and if you attempt to decipher the files manually it may take forever. Paying the ransom, on the other hand, does not guarantee that the cyber criminals will provide the decryption key. Experts remind that the safest way to protect your valuable data from ransomware is to perform regular backups.
As Coin Locker enters the system it scans for the following types of files: 3fr, accdb, cer, cr2, crt, crw, dbf, xlk, xls, xlsb, xlsm, dcr, der, dng, doc, docm, ai, arw, bay, cdr, docx, dwg, dxf, dxg, eps, erf, indd, jpe, jpg, kdc, mdb, mdf, odm, odp, ods, odt, orf, p12, p7b, p7c, pdd, pef, pem, pfx, ppt, pptm, pptx, psd, mef, mrw, nef, nrw, odb, pst, ptx, r3d, raf, raw, rtf, rw2, rwl, srf, srw, wb2, wpd, wps, xlsx, etc.
Coin Locker can add the extension .encrypted to each of the above-mentioned files and thus leave the user unable to open them.
Coin Locker – Infiltration Method
Like other ransomware in the wild, such as Cryptolocker, Cryptorbit, CTB-Locker, etc., Coin Locker enters the user’s system via corrupted attachments to email messages, drive-by downloads or bundled with freeware. Most spam emails that spread different malware are designed to look like ordinary messages from legitimate institutions or reputable companies, supposedly containing documents, invoices or even bills. Grammar mistakes and misspelled words can be a clear sign that you are dealing with a scam.
Do not open emails from an unknown sender and make sure that you AV tools are up to date.
Coin Locker – The Ransom Message
Coin Locker displays a message informing the victim that the access to the files has been restricted and demanding payment via the TOR anonymous network.
Here is what the ransom message looks like:
→Your system has been infected with the Coin Locker malware.
All your files have been encrypted.
To regain access to your files, you need the Coin Locker decryption software.
To obtain our software you need to access the Web with TOR.
You can download TOR here:
Start TOR and navigate to our web page:
Follow the steps provided on the site to unlock your files using the decryption software.
Remove Coin Locker and Restore the Encrypted Files
Stage One: Remove Coin Locker
1. First and most important – download and install a legitimate and trustworthy anti-malware scanner, which will help you run a full system scan and eliminate all threats.
Spy Hunter FREE scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the malware tool. Find Out More About SpyHunter Anti-Malware Tool
2. Run a second scan to make sure that there are no malicious software programs running on your PC. For that purpose, it’s recommended to download ESET Online Scanner.
Your PC should be clean now.
Stage Two: Restore the Encrypted Files
Option 1: Best case scenario – You have backed up your data on a regular basis, and now you can use the most recent backup to restore your files.
Option 2: Try to decrypt your files with the help of Kaspersky’s RectorDecryptor.exe and RakhniDecryptor.exe. They might help you in the process but keep in mind that they were not specially designed to encrypt information that was decrypted by this particular ransomware.
Option 3: Shadow Volume Copies
1. Install the Shadow Explorer, which is available with Windows Vista, Windows 7, Windows 8 and Windows XP Service Pack 2.
2. From Shadow Explorer’s drop down menu choose a drive and the latest date you would like to restore information from.
3. Right-click on a random encrypted file or folder then select “Export”. Select a location to restore the content of the selected file or folder.
Remove Coin Locker Automatically with Spy Hunter Malware – Removal Tool.
To clean your computer with the award-winning software Spy Hunter –
It is highly recommended to run a FREE scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter.