A ransomware virus that attacks the files of it’s victims only to archive them in password protected .ZIP files has been reported to wreak havoc on user computers. The virus moves all of the archived files in a RarVault folder on the drives of the user and also leaves behind a ransom note, named RarVault.htm. Judging by the information available, the virus was created to infect the computers of russian speaking users, but the ransom note is in English, suggesting it may be spread to other areas of the world as well. Not only this, but RarVault Ransomware also aims to intimidate users claiming the original sum for the ransom payoff to be 1 BTC but it can rise up depending on the importance of the files of the user it can raise up to the insane sum of 50 BitCoins. Everyone who has had their files archived and locked by RarVault ransomware should seek alternative methods to restore the files and remove RarVault from their computer.
|Short Description||The malware encrypts users files using a strong AES-256 encryption algorithm, making direct decryption possible only via a unique decryption key available only for the cyber-criminals.|
|Symptoms||The user may witness ransom notes and “instructions” and a sound message all linking to a web page and a decryptor. It doesn’t change file names or file extensions.|
|Detection Tool|| See If Your System Has Been Affected by RarVault |
Malware Removal Tool
|User Experience||Join our forum to Discuss RarVault Ransomware.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
RarVault Ransomware – How Does It Spread
The cyber-crooks behind RarVault are rather clever – they use a set of combined malicious tools to slip past any protection of the executable of RarVault ransomware. One of those tools is believed to be an exploit kit, that uses an exploit in Windows to cause an infection. These types of kits are very expensive because they include bugs of an operating system or other software installed on it that haven’t been revealed yet. Not only this, but the team behind RarVault ransomware may also disguise the malicious file as a legitimate Microsoft Word, Excel or Adobe PDF type of document and upload it online on shady websites or send it out in massive spam e-mail campaigns.
Other methods of distributing the malicious executable are via uploading it as a fake game crack or a Windows activator-like KMS Pico. To combine it with other programs, the cyber-criminal team behind RarVault may have used so-called file joiners.
Not only this but for it’s malicious files to run undetected, malware obfuscators may have been used that make the file completely undetected by any anti-virus software as long as the obfuscator is good quality.
RarVault Ransomware – More About It
Similar to the Auinfo16 virus, when it’s malicious file is executed on your computer you may briefly notice it go into a “Not Responding” state. This means that RarVault virus has taken over and is performing heavy modifications to your files. According to malware researchers, the RarVault virus tracks every drive of your computer, no matter if it is C:/ D:/ E:/, it may even attack the remote drives, like flash drives or other devices with a flash memory connected to the computer. Once the virus has detected the files it wants to modify, it immediately moves them to a folder, named RarVault, for example:
This folder contains the following files:
Both of those files have a very specific purpose. The .txt file, for example, has the names of each and every file to which the RarVault virus has denied access. The .rar file is a bit bigger in size, and it is a password protected archive that may contain the files in it.
The RarVault virus looks for files that could be important, like:
- Microsoft Office documents.
- Adobe documents.
- Audio files.
- Other files of great importance.
As soon as it has locked the files away from you on your computer, this virus then displays the following ransom note, called “RarVault.htm” in English:
Based on this ransom note the RarVault virus not only archives the files but also uses the Advanced Encryption Standard (AES) algorithm to cipher the files as well, leaving the user with no option, even after the.RAR file is unlocked. This is primary because the cipher is with 256-bit strength, making it a military grade encryption in strength and it would take years to crack. However, malware researchers strongly advise against paying the ransom money to these cyber-criminals and exploring other options to restore the files after removing the RarVault ransomware.
RarVault Ransomware – Removal And File Restoration
For the removal of the RarVault virus, you should have some experience. We have provided removal instructions after this article which you can follow, but for maximum effectiveness and easiest removal, experts recommend scanning your computer with an advanced anti-malware program. This will enable you to fully erase RarVault ransomware at the click of a button and will also significantly increase your protection from malware in general.
In case you are looking for alternative methods to get the password, we have provided some methods below. But do not hope for a miracle, because these methods may work only in some specific situations and may not be 100% effective. We are going to keep monitoring the development of the situation and will update this article once a decrypter has been released, so we suggest you too keep an eye on it.