Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove REKTLocker Ransomware and Restore .rekt Encrypted Files

rektlocker-ransom-note-sensorstechforumRansomware variant, known by the name REKTLocker has been reported to use the .rekt file extension and the RSA-2048 encryption algorithm to encipher user data. The virus then changes the wallpaper with the ransom demands, wanting the sum of 1 BTC as a ransom payoff. Users who have become unfortunate victims of this malware are strongly advised by experts NOT to pay any ransom money and fight off this malware by isolating it and removing it and trying to restore the files themselves. We recommend that you read this article thoroughly to learn more information about REKTLocker ransomware and how to restore your files and remove it from your system.

Threat Summary

Name

REKTLocker

TypeRansomware Virus
Short DescriptionREKTLocker encrypts the files of the systems it infects, asking 1 BTC as a ransom payoff.
SymptomsFiles are encrypted and no longer accessible with an added .rekt file extension and a dropped Readme.txt file.
Distribution MethodVia malicious URLs, malicious e-mail attachments or other forms of online spam.
Detection Tool See If Your System Has Been Affected by REKTLocker

Download

Malware Removal Tool

User ExperienceJoin our forum to Discuss REKTLocker Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

REKTLocker – Distribution Methods

Similar to other ransomware, to spread and infect victims while they are unsuspecting, REKTLocker may use a set of tools that might help it reach its goals:

  • Malware obfuscators.
  • JavaScript files.
  • Exploit Kits.
  • Spam bots or spamming services.
  • Third-party advertisers and ad-supported PUP services.

These tools may be used to slither the malware in the form of malicious web links or malicious attachments. The web links may seem legitimate when scanned for malware, but they may cause browser redirects to the actual infection URLs that may inject a malicious script and drop the payload in a drive-by manner.

Malicious attachments, however, may carry an exploit kit or be in a .js, .exe, .dll or .tmp files which may cause the infection. Such are primarily posted as e-mail attachments that usually resemble Adobe Reader or Microsoft Office documents.

REKTLocker – More Information

As soon as REKTLocker has been initiated on the computer of the user, it may drop its malicious files in the following folders:

  • %AppData%
  • %Temp%
  • %Roaming%
  • %Local%
  • %SystemDrive%
  • %User’s Profile%
  • %Windows%

The files dropped by REKTLocker may be more than one, and they may have different file formats depending on what they have been created to do. For example, if the ransomware drops a .BAT (Batch file) it is most likely dropped to delete the backups and shadow volume copies of the computer, using the following administrative command:

→ vssadmin delete shadows /all /quiet

As soon as it has dropped the files, the REKTLocker ransomware may create malicious registry values in the following Windows Registry keys for it’s executable that encrypts files to run when Windows starts up:

→ HKEY_LOCAL_MACHINE\Software \Microsoft\Windows\ CurrentVersion \Run
HKEY_CURRENT_USER\ Software\Microsoft \Windows\ CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft \Windows\ CurrentVersion\RunOnce
HKEY_CURRENT_USER\ Software\Microsoft \Windows\CurrentVersion \RunOnce

After this has been done, REKTLocker may begin the encryption process. The virus may use an RSA-2048 encryption algorithm which will generate a decryption key and send it to the cybercriminals’ C&C (Command and Control) server after encrypting files of the following type:

  • Audio files.
  • Pictures and other image files.
  • Video files.
  • Databases.
  • Photoshop files.
  • Microsoft Office documents.
  • Web files.
  • Other files associated with widely used software.

After the encryption has been completed, REKTLocker ransomware changes the structure of the files making them inaccessible and looking like the following example:

encrypted-picture-rektlocker-ransowmare-sensorstechforum

After encryption, the REKTLocker ransomware adds a Readme.txt file along with a photo which it changes as a wallpaper. Here is what they both state:

Picture:
“You PC has been locked with 2048 bit encryption.
REKTLocker”
Readme.txt file:
“Your computer has been encrypted.
Send 1 BTC to 1NuLLtgCmigRb5mXeFgsGDFnVLypLC4a8Y or your files will be permanently encrypted.
Decryptor:
Other peoples keys will not work on your computer.
Do not think your antivirus will save you; it will not.”

REKTLocker Ransomware – Conclusion, Removal, and File Restoration

As a bottom line, REKTLocker has most likely been purchased as a service (RaaS) online from a deep web forum and the people behind it, have inserted some crooked humor, by including the file extension .rekt in it, with a reference to a so-called “owning” in video games. We advise not to respect the demands of these cyber-crooks and focus on dealing with the threat yourself. To do this, you should first remove REKTLocker ransomware and after this, focus on getting your files back by following the instructions below.

To remove REKTLocker, we have designed methodologically arranged steps that will help you with manually locating and removing the files as long as you have the exact knowledge of where all the files are. For maximum effectiveness, we urge you to use an advanced anti-malware program, because it will not only automatically detect and remove REKTLocker and other hazards to your PC, but will also protect it in the future as well.

In case you are interested in restoring your files, make sure to back the encrypted data first and DO NOT reinstall Windows. This will help programs such as data recovery software which we suggest using in step “3. Restore files encrypted by REKTLocker” to act more effectively and revert at least a small portion of your files. While you attempt to restore your files, we also strongly recommend following this article and our updates, since we will immediately post an update as soon as malware research experts have released a free decryptor for REKTLocker ransomware.

Manually delete REKTLocker from your computer

Note! Substantial notification about the REKTLocker threat: Manual removal of REKTLocker requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove REKTLocker files and objects
2. Find malicious files created by REKTLocker on your PC
3. Fix registry entries created by REKTLocker on your PC

Automatically remove REKTLocker by downloading an advanced anti-malware program

1. Remove REKTLocker with SpyHunter Anti-Malware Tool
2. Back up your data to secure it against infections and file encryption by REKTLocker in the future
3. Restore files encrypted by REKTLocker
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.