A new ransomware, carrying the vulgar name of its ransom email address, [email protected] has been reported to be massively spread. It encrypts the user files with a strong cypher and uses the ransom email plus a .xtbl file extension after it. The questionable malware is believed by security experts to be a part of RaaS (Ransomware as a service) operation because it has many variants.
Threat Summary
| Name | [email protected] |
| Type | Ransomware |
| Short Description | Part of the “@” ransomware variants. Encrypts the files on the infected computer then asks for ransom money in email correspondences. |
| Symptoms | The user may witness his files to become corrupt with the questionable email and .xtbl as file extensions that are added. |
| Distribution Method | Via Exploit kits or downloader Trojans. |
| Detection Tool | See If Your System Has Been Affected by [email protected] Download Malware Removal Tool |
| User Experience | Join our forum to Discuss [email protected] Ransomware. |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
[email protected] – How Did I Get It
The most likely method that the [email protected] crypto-malware may have used to spread onto the user PCs may be via two main methods:
- Malicious URLs posted as spam comments on forums or other social websites.
- Malicious URLs featured in spam emails may resemble like they are originating from a legitimate service.
Either way, the [email protected] ransomwar may also not come directly onto the computer, but arrive via other malware. The most often used malware to download crypto-viruses are MSIL Trojans and Exploit Kits, such as the Angler Exploit Kit. Since their executables are obfuscated by the so-called cryptors or obfuscating software, it is difficult for a conventional antivirus software to detect them. The distribution malware may either open a port, connect to a host and download the malicious .exe via the port or directly create an exploit for the attackers.
[email protected] Ransomware In Detail
Similar to other variants, like [email protected] or [email protected] this variant may drop its payload in several locations:
- %UserProfile%
- %Roaming%
- %AppData%
The files dropped may be of the following file types:
→ .exe, .dll, .tmp
Each one of the modules of this ransomware may have different function. The malware then may set a registry key to run on system startup after which look for the most commonly used file types and encrypt them.
An encrypted file by the [email protected] ransomware looks as follows:
The [email protected] virus then may change the wallpaper of the user to a wallpaper that asks the user to contact the questionable e-mail for further instructions. Here is what the wallpaper states:
→ “WARNING!!!
Important files on this PC are locked
If you want to reset this operation send one locked file to this email:
[email protected]
reserve:[email protected]
Important information: You only have 3 days to reply to this email before unlocking becomes impossible.”
The [email protected] ransomware also has a text file, named “How to decrypt your files.txt”. Judging by what type it is this ransomware is most likely sold on the dark web as a service for cyber-criminals who do not have the experience to program their own [email protected] ransomware. This is why all of the “@” types of ransomware use a specific contact email address that is unique to them and different wallpaper. However, they may be very similar in their structure.
Remove Redshitline Ransomware and Restore .Xtbl Files
In order to delete this ransomware, it is strongly advisable to use an advanced anti-malware software. Furthermore, we strongly recommend using the advanced anti-malware software because it will remove the ransomware and other malware that be executed on your computer without damaging your files.
Regarding file restoration, we recommend using the methods outlined in Step “4” from the instruction below.
Manually delete [email protected] from your computer
Note! Substantial notification about the [email protected] threat: Manual removal of [email protected] requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.
1. For Windows 7,XP and Vista.
2. For Windows 8, 8.1 and 10.
Automatically remove [email protected] by downloading an advanced anti-malware program
1. Install SpyHunter to scan for and remove 
1. For Windows 7 and earlier
STOPZilla Anti Malware
I have a customer with this virus. It started encrypting network shares on March 21st.
The system infected is a virtual machine, so it is now shutdown without being cleaned.
I tried Kaspersky Rakhni Decryptor and Rannoh Decryptor, but with no luck. Rakhni Decryptor gives an unsupported file type error. Rannoh Decryptor gives an error Can’t initialize on pair followed by Can’t init decryptor.