Home > Ransomware > Remove GNL Locker Ransomware and Restore .locked AES-512 Files

Remove GNL Locker Ransomware and Restore .locked AES-512 Files

ransom-note-gnl-locker-sensorstechforumRansomware, called GNL Locker(German-Netherlands Locker) which uses the never seen before AES-512 encryption algorithm has been spotted out in the wild. The dangerous malware encrypts the user files adding a .locked file extension to them. After this, it has been reported to drop several files which are its ransom note, demanding around 200 euros in them. Since the GNL Locker ransomware may spread via a Trojan.Downloader, experts advise users to be extremely careful what they download on their hard drives and what malicious URLs they are clicking on. In case you have been affected by this ransomware, it is strongly recommended to take immediate actions into removing it and restoring your files using alternative methods such as the ones posted after this article.

Threat Summary

Name GNL Locker
Type Ransomware
Short Description The ransomware encrypts files and may use the AES-512 cipher. Asks a ransom money of around 200 euros(0.6 BTC) for decryption.
Symptoms Files are encrypted with .locked file extension and become forbidden for access. The ransomware drops a “UNLOCK_FILES_INSTRUCTIONS” ransom note.
Distribution Method Spam Emails, Email Attachments, File Sharing Networks.
Detection Tool See If Your System Has Been Affected by malware


Malware Removal Tool

User Experience Join our forum to Discuss GNL Locker Ransomware.
Data Recovery Tool Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

GNL Locker – How Did I Get Infected

To infect user systems, this ransomware is reported by affected users to use a malicious .exe file which is reportedly a Trojan.Downloader types of malware. This threat then downloads a malicious .bat file from one of the C&C (Command and Control) servers of the cyber-criminals. However, so far there is no information on the methods of distribution of the malware and whether it uses attachments or malicious URLs and how is the spam sent out to infect users with GNL Locker.

However, researchers believe that the malicious .exe may pose as an installer of a program posted on suspicious websites. Not only this but it may be featured as an attachment on spammed e-mails that may resemble different legitimate services, for example:

  • FedEx.
  • eBay.
  • PayPal.
  • Government branches.
  • Banking executives.
  • Amazon.
  • Services or sites, the user, has registration in.

Users who have not yet been infected should avoid spam messages of the following character or use e-mailing software that has spam blocking features in it and e-mail provider with anti-malware checks.

GNL Locker In Detail

Once GNL Locker has been downloaded onto the computer of the user, the ransomware (also known as crypto-malware) begins to set up for file encryption. For starters, it may drop malicious modules in the following file folders, and those executables, temporary files or DLL’s may have random names, for example:

commonly used file names and folders

After it does that, similar to TeslaCrypt ransomware, GNL Locker may modify the registry entries of the infected computer so that it is automatically started when you turn on the infected system and boot Windows:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

GNL Locker – The AES Encryption

After doing so, this ransomware may initiate the file encryption procedure. It may either be done via using a combination of AES and RSA encryption ciphers or as the ransomware writers claim in the ransom message, GNL may use the immensely strong AES-512 encoding cipher. Until recently, experts have considered AES-512 to be an algorithm that is simply too big and too long and in many cases obsolete since the size of the key was 512 bit. They have found that AES-256 and 192 keys were sufficient. However, with the recent developments in cryptography the AES-512 has become an even more discussed subject in the cryptography field. As the researcher Adam Caudill believes, the older algorithms may be rendered obsolete soon if a method for their decryption has been discovering (if it already hasn’t been).

So the bottom line is that GNL Locker, in fact, may for the first time use the immensely strong AES-512 key which is quite interesting. But there is also the other version – it may just claim to use it to scare off users into paying the ransom. In fact, user who has paid the actual ransom have stated that they have gotten their files back which is quite suspicious because developing ransomware that uses AES-512 and returning the files 100% healthy may be a bit tricky. For it to work successfully, one must use officially proposed encryption process designs whose code and functionality were tested.

GNL Locker – The Final Stage of Infecting Your PC

Once it has successfully infected your computer, GNL Locker Ransomware changes the name of your encrypted files with the .locked file extension, just like Locky ransomware and it renames the files with random names, just like CryptoWall 4.0 Ransomware, for example:

→ 1298d12g!!.txt.locked

In addition to that GNL drops the ransom note. It consists of two files:


The .txt file aims to notify the user into opening the HTML ransom document, for example:

→ Open UNLOCK_FILES_INSTRUCTIONS.html with your internet browser to see the instructions.

The HTML document itself has the ransom note that demands money to unlock the files:

→ “Your files are locked / encrypted
You can unlock your files by paying requested amount{amount usually around 200 Euros}
All your important files are encrypted using an unique 32 characters AES-512 ({for some variants 256}) password. (it will take a computer over a billion years to crack this password.
Lucky for you it is possible to get all your files back!
In order to unlock your files you will have to purchase the private password for this computer For more information navigate to your personal unlocking page below.
Warning! You must pay the specified amount before {Deadline date} or the amount you have to pay will TRIPLE!
Important information
Your UID: {unique identification number}
Use one of the links below to pay and receive instructions for unlocking your files.
{three tor web links}
If none of the above websites work follow the steps below.
1.Download the Tor Browser Bundle
2.Start the Tor Browser Bundle
3.Enter {tor web link} in the website address bar of the Tor Browser Bundle.”

Not only this but the malware is different to track, because it usually may use different encryption strengths, like AES-256 for some computers and 512 for others, as infected users on BleepingComputer forums have reported.

DNL Locker – Conclusion, Removal, and File Restoration Alternatives

The bottom line is that this is what appears to be a sophisticated ransomware, and it is most likely a part of a RaaS(“ransomware as a service” scheme), because different variants of it exist, demanding different payments and claiming to use different ciphers. This points out that GNL Ransomware may have been sold on deep web black markets.

The best way to get rid of this ransomware is to isolate it in safe mode. This is why we have provided instructions below which you can feel free to follow and hopefully they may help you to get permanently rid of this threat.

If you want to decrypt your files however, we have to note that currently direct decryptor has not been released. This is due to the uniqueness of the keys being used. The only realistic options to get all your files back are to (i)wait for researchers to discover a flaw in the code of the virus itself (we will post an update here) or (ii) try the alternative methods for file restoration (“Restore files encrypted by GNL Locker” below)that may restore even a small portion of your files. They include using Shadow Copies in case you have a backup set up on your Windows device, using File restoration software and the technical option of sniffing out information about the encryption.

Ventsislav Krastev

Ventsislav is a cybersecurity expert at SensorsTechForum since 2015. He has been researching, covering, helping victims with the latest malware infections plus testing and reviewing software and the newest tech developments. Having graduated Marketing as well, Ventsislav also has passion for learning new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management, Network Administration and Computer Administration of System Applications, he found his true calling within the cybersecrurity industry and is a strong believer in the education of every user towards online safety and security.

More Posts - Website

Follow Me:

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

How to Remove GNL Locker from Windows.

Step 1: Boot Your PC In Safe Mode to isolate and remove GNL Locker


Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!
We Recommend To Scan Your PC with SpyHunter

Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter's EULA, Privacy Policy and Threat Assessment Criteria

1. Hold Windows key() + R

2. The "Run" Window will appear. In it, type "msconfig" and click OK.

3. Go to the "Boot" tab. There select "Safe Boot" and then click "Apply" and "OK".
Tip: Make sure to reverse those changes by unticking Safe Boot after that, because your system will always boot in Safe Boot from now on.

4. When prompted, click on "Restart" to go into Safe Mode.

5. You can recognise Safe Mode by the words written on the corners of your screen.

Step 2: Uninstall GNL Locker and related software from Windows

Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:

1. Hold the Windows Logo Button and "R" on your keyboard. A Pop-up window will appear.

2. In the field type in "appwiz.cpl" and press ENTER.

3. This will open a window with all the programs installed on the PC. Select the program that you want to remove, and press "Uninstall"
Follow the instructions above and you will successfully uninstall most programs.

Step 3: Clean any registries, created by GNL Locker on your computer.

The usually targeted registries of Windows machines are the following:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

You can access them by opening the Windows registry editor and deleting any values, created by GNL Locker there. This can happen by following the steps underneath:

1. Open the Run Window again, type "regedit" and click OK.

2. When you open it, you can freely navigate to the Run and RunOnce keys, whose locations are shown above.

3. You can remove the value of the virus by right-clicking on it and removing it.
Tip: To find a virus-created value, you can right-click on it and click "Modify" to see which file it is set to run. If this is the virus file location, remove the value.

Before starting "Step 4", please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.

Step 4: Scan for GNL Locker with SpyHunter Anti-Malware Tool

1. Click on the "Download" button to proceed to SpyHunter's download page.

It is recommended to run a scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter. Click on the corresponding links to check SpyHunter's EULA, Privacy Policy and Threat Assessment Criteria.

2. After you have installed SpyHunter, wait for it to update automatically.


3. After the update process has finished, click on the 'Malware/PC Scan' tab. A new window will appear. Click on 'Start Scan'.


4. After SpyHunter has finished scanning your PC for any files of the associated threat and found them, you can try to get them removed automatically and permanently by clicking on the 'Next' button.


If any threats have been removed, it is highly recommended to restart your PC.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Get rid of GNL Locker from Mac OS X.

Step 1: Uninstall GNL Locker and remove related files and objects

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!
We Recommend To Scan Your Mac with SpyHunter for Mac
Keep in mind, that SpyHunter for Mac needs to purchased to remove the malware threats. Click on the corresponding links to check SpyHunter’s EULA and Privacy Policy

1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:

2. Find Activity Monitor and double-click it:

3. In the Activity Monitor look for any suspicious processes, belonging or related to GNL Locker:

Tip: To quit a process completely, choose the “Force Quit” option.

4. Click on the "Go" button again, but this time select Applications. Another way is with the ⇧+⌘+A buttons.

5. In the Applications menu, look for any suspicious app or an app with a name, similar or identical to GNL Locker. If you find it, right-click on the app and select “Move to Trash”.

6: Select Accounts, after which click on the Login Items preference. Your Mac will then show you a list of items that start automatically when you log in. Look for any suspicious apps identical or similar to GNL Locker. Check the app you want to stop from running automatically and then select on the Minus (“-“) icon to hide it.

7: Remove any left-over files that might be related to this threat manually by following the sub-steps below:

  • Go to Finder.
  • In the search bar type the name of the app that you want to remove.
  • Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
  • If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.

In case you cannot remove GNL Locker via Step 1 above:

In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:

Disclaimer! If you are about to tamper with Library files on Mac, be sure to know the name of the virus file, because if you delete the wrong file, it may cause irreversible damage to your MacOS. Continue on your own responsibility!

1: Click on "Go" and Then "Go to Folder" as shown underneath:

2: Type in "/Library/LauchAgents/" and click Ok:

3: Delete all of the virus files that have similar or the same name as GNL Locker. If you believe there is no such file, do not delete anything.

You can repeat the same procedure with the following other Library directories:

→ ~/Library/LaunchAgents

Tip: ~ is there on purpose, because it leads to more LaunchAgents.

Step 2: Scan for and remove GNL Locker files from your Mac

When you are facing problems on your Mac as a result of unwanted scripts and programs such as GNL Locker, the recommended way of eliminating the threat is by using an anti-malware program. SpyHunter for Mac offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.

Click the button below below to download SpyHunter for Mac and scan for GNL Locker:


SpyHunter for Mac

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Remove GNL Locker from Google Chrome.

Step 1: Start Google Chrome and open the drop menu

Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"

Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.

Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Erase GNL Locker from Mozilla Firefox.

Step 1: Start Mozilla Firefox. Open the menu window

Step 2: Select the "Add-ons" icon from the menu.

Step 3: Select the unwanted extension and click "Remove"

Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Uninstall GNL Locker from Microsoft Edge.

Step 1: Start Edge browser.

Step 2: Open the drop menu by clicking on the icon at the top right corner.

Step 3: From the drop menu select "Extensions".

Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.

Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Remove GNL Locker from Safari.

Step 1: Start the Safari app.

Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.

Step 3: From the menu, click on "Preferences".

stf-safari preferences

Step 4: After that, select the 'Extensions' Tab.


Step 5: Click once on the extension you want to remove.

Step 6: Click 'Uninstall'.

stf-safari uninstall

A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the GNL Locker will be removed.

How to Reset Safari
IMPORTANT: Before resetting Safari make sure you back up all your saved passwords within the browser in case you forget them.

Start Safari and then click on the gear leaver icon.

Click the Reset Safari button and you will reset the browser.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer Stop Push Pop-ups

Eliminate GNL Locker from Internet Explorer.

Step 1: Start Internet Explorer.

Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'

Step 3: In the 'Manage Add-ons' window.

Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.

Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.

Remove Push Notifications caused by GNL Locker from Your Browsers.

Turn Off Push Notifications from Google Chrome

To disable any Push Notices from Google Chrome browser, please follow the steps below:

Step 1: Go to Settings in Chrome.


Step 2: In Settings, select “Advanced Settings”:

advanced settings

Step 3: Click “Content Settings”:

Content Settings

Step 4: Open “Notifications”:


Step 5: Click the three dots and choose Block, Edit or Remove options:

Block, Edit or Remove

Remove Push Notifications on Firefox

Step 1: Go to Firefox Options.


Step 2: Go to “Settings”, type “notifications” in the search bar and click "Settings":


Step 3: Click “Remove” on any site you wish notifications gone and click “Save Changes”

remove push notifications firefox

Stop Push Notifications on Opera

Step 1: In Opera, press ALT+P to go to Settings


Step 2: In Setting search, type “Content” to go to Content Settings.

content settings

Step 3: Open Notifications:


Step 4: Do the same as you did with Google Chrome (explained below):

three dots

Eliminate Push Notifications on Safari

Step 1: Open Safari Preferences.


Step 2: Choose the domain from where you like push pop-ups gone and change to "Deny" from "Allow".

Leave a Comment

Your email address will not be published. Required fields are marked *