Gorgon ransomware is an infection that encrypts valuable files by utilizing one or more sophisticated cipher algorithms. Once started on a PC, it initiates a sequence of malicious operations that plague essential system settings. By doing this, Gorgon becomes able to corrupt target files and mark them with the extension .[firstname.lastname@example.org] . Unfortunately, corrupted files cannot be opened until their code is reverted back to its original state.
In this article, you will find out how to remove Gorgon ransomware and how to attempt to restore encoded files.
|Short Description||Encrypts valuable files stored on infected computers. Appends them the extension .[email@example.com] and extorts a ransom fee for thier decryption.|
|Symptoms||You cannot open files renamed with .[firstname.lastname@example.org] extension. Your desktop wallpaper is changed with a ransom image.|
|Distribution Method||Spam Emails, Email Attachments, Infected Installers|
|Detection Tool|| See If Your System Has Been Affected by Gorgon |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Gorgon.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Gorgon Ransomware – Distribution
For the spread of Gorgon ransomware, hackers are likely to use some of the most popular techniques. Such are malspam, software installers, links to infected web pages, forums, social media channels, fake software update notifications and other.
Among all these techniques malspam is likely to be the main one. Like the majority of ransomware infections that are spread in massive email spam campaigns, Gorgon is also believed to be spread this way. The technique enables hackers to include ransomware’s payload in deceptive emails that pose as legitimate organizations and businesses. Components like URL addresses, in-text links, buttons, images, and file attachments are often presented in such emails as they could be all misused for the delivery of the ransomware payload.
In order to make you more prone to interact with such a component and as a result enable the ransomware to access your system, the text messages in these emails try to provoke a sense of urgency.
Gorgon Ransomware – Overview
Gorgon ransomware contaminates computer systems in order to encode valuable files and extort ransom payment from its victims. Infection with this threat could be recognized by its associated extension .[email@example.com]
To start the infection process, Gorgon needs to execute its payload file on the machine. As revealed by analyses published by security researchers, this file is called Gorgon.exe. Further analyses of the threat indicate that once executed on a target system, this file initiates a long sequence of malicious activities. Among these activities is believed to be the creation of additional malicious files and objects.
Here are the names of the folders that may be used for the storage of files associated with Gorgon ransomware:
When established, these files are executed in a predefined order written in ransomware’s code. Successful execution of malicious files enables the ransomware to evade detection and eventually complete the attack to its very end. There is no doubt that the purpose of these files is the corruption of essential system components. And since the Registry Editor is among targeted components, you should know that Gorgon ransomware will be able to load its infection files each time you start the infected system until you clear malicious entries added under Run registry key. The manipulation of another registry key’s functionalities (RunOnce), on the other hand, could replace the preferred desktop wallpaper with the following image:
This image depicts the following message:
All your important files have been encrypted!
If you want to decrypt your files
Please read the “#DECRYPT MY FILES#.HTML” for help
The purpose of this image is to inform you about the presence of Gorgon ransomware on your computer and guide you to another file called #DECRYPT MY FILES#.HTML where more details left by hackers could be revealed. When you find and open this file you are likely to see the this window:
What it informs is:
All your important files are encrypted!
All your important files(database,documents,images,videos,music,etc.)have been encrypted!and onlywe can decrypt!
To decrypt your files, you need to buy Gorgon Decryptor from us,we are the only one who can decrypt the file for you
Trying to reinstall the system and decrypting the file with a third-party tool will result in file corruption,which means no one can decrypt your file(including us)!
If you still try to decrypt the file yourself,you do so at your own risk!
As a proof,you can email us 3 files to decrypt,and we will send you the decrypted files to prove that we can decrypt your files
#How to decrypt?
1.Buy 0.3 Bitcoin at https://localbitcoins.com
Email [firstname.lastname@example.org] Your ID
Apparently, the demanded ransom is 0.3 Bitcoin which at the moment of writing this article equals to 1,023.75 United States Dollars. For the sake of your security, we recommend you to avoid contacting hackers. Even a successful ransom payment does not guarantee the recovery of your .[email@example.com] files. Cyber criminals could always decide to neglect your messages and send you no reply. Furthermore, since their decryptor may be broken, it may not be able to restore files.
Gorgon Ransomware – Encryption Process
For the encryption of target types of files, Gorgon ransomware activated a built-in cipher module. This module is designed to scan the infected system for files which usually store important data so it can transform parts of their code by means of sophisticated cipher algorithm. Unfortunately, encrypted could be all your:
- Audio files
- Video files
- Document files
- Image files
- Backup files
- Banking credentials, etc
The end of the encryption phase could be recognized by the appearance of the extension .[firstname.lastname@example.org] in the names of all corrupted files. Information stored by corrupted files remains out of reach until their code is reverted back to its original state.
Remove Gorgon Ransomware and Restore Data
Gorgon ransomware is a threat with highly complex code designed to corrupt both system settings and valuable data. So the only way to use your system in a secure manner again is to remove all malicious files and objects created by the ransomware. For the purpose, we prepared a removal guide that reveals how to clean and secure your system step by step. In addition, you will find several alternative data recovery approaches that may be helpful in attempting to restore files encrypted by Gorgon ransomware. We need to remind you to back up all encrypted files to an external drive before the recovery process.