Remove RotorCrypt Ransomware and Restore .c400 Files - How to, Technology and PC Security Forum | SensorsTechForum.com
THREAT REMOVAL

Remove RotorCrypt Ransomware and Restore .c400 Files

OFFER

SCAN YOUR PC
with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by RotorCrypt and other threats.
Threats such as RotorCrypt may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

stf-rotorcrypt-ransomware-rotor-elizabeth7-protonmail-com-likbez77777-gmail-com-virus-ransom-message-small

RotorCrypt is the new name of the previously known Rotor cryptovirus. The virus is also ransomware as its past iteration. After the encryption of your files, the extension .c400 will be appended to them along with one of two emails. The emails are [email protected] and [email protected] To see how to remove the virus and how you can try to restore your encrypted files, read the whole article.

Threat Summary

NameRotorCrypt
TypeRansomware, Cryptovirus
Short DescriptionThe virus will encrypt your files and demand a ransom as payment for their decryption.
SymptomsThe ransomware appends the .c400 extension to encrypted files. It asks for payment in Bitcoins to the [email protected] and [email protected] email addresses.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by RotorCrypt

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss RotorCrypt.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

RotorCrypt Ransomware – Update February 2018

Update! A decryption tool is now available for the RotorCrypt ransomware! The tool was created by malware researchers from Kaspersky and can be downloaded from the following link, wrapped inside a .zip archive: Rakhni Decryption Tool.

RotorCrypt Ransomware – Delivery

The RotorCrypt ransomware could be delivered to your computer using different ways. Its payload file could be spread with spam email campaigns. With these emails, the file could be attached and made to look as important. The entirety of the email may look legitimate and try to trick you that you need to open the attachment because its full contents cannot be conveyed in the email body. However, if you open that file, your computer becomes infected. The file can be heavily obfuscated and is in most cases an executable.

stf-rotorcrypt-ransomware-rotor-elizabeth7-protonmail-com-likbez77777-gmail-com-virus-total-analysis-exe-detections

From the analysis report shown above, you can view that on the VirusTotal site, the file is named Trojan-Ransom.Win32.Rotor.b as some of the detections. The developers of this ransomware could be delivering the file with targeted attacks or through sharing services and social media. Do not be opening executables from suspicious emails, especially if they are of unknown origins. Scan these files with a security tool and check their signatures and size, beforehand. You should take a look at the ransomware prevention tips in our forum topic.

RotorCrypt Ransomware – Description

RotorCrypt ransomware is discovered to be a new variant of the Rotor Virus (cocoslim98). Now, it uses new executables to spread its malicious files. You can view in the Payload Security platform, the detection of one such executable file is called GWWABPFL.exe:

stf-rotorcrypt-ransomware-rotor-elizabeth7-protonmail-com-likbez77777-gmail-com-virus-payload-security-report

When the payload file of the RotorCrypt virus is executed on a computer, it spawns lots of processes, according to the malware researchers of Payload Security. The virus is still mainly orientated around targeting servers, although many Windows machines have been infected, too.

When RotorCrypt is active, it could set up values in the Windows Registry, whereupon it gains persistence. The values are set inside entries of that registry and make the ransomware launch automatically with every boot of the Windows operating system. Afterward, files get encrypted, and a tiny note with the payment instructions is created. You can view that ransom note in the screenshot right here:

stf-rotorcrypt-ransomware-rotor-elizabeth7-protonmail-com-likbez77777-gmail-com-virus-ransom-message

The ransom note reads the following:

Good day

Your files were encrypted/locked
As evidence can decrypt file 1 to 3 1-30MB
The price of the transcripts of all the files on the server: 7 Bitcoin

Recommend to solve the problem quickly and not to delay

Also give advice on how to protect Your server against threats from the network

(Files sql mdf backup decryption strictly after payment)!

The RotorCrypt ransomware does not give you any specific deadline for paying the criminals for the data decryption process. It also makes the offer of free decryption for a couple of files as a testing procedure. Nonetheless, its demands are high with the ransom amount which is demanded and that the decryption of some files will be only available after payment. The ransom price that is asked is 7 Bitcoins, and that amounts to over 4400 US dollars.

You shouldn’t think of paying these extortionists, as no one can guarantee that you will return your files to what they were after payment. The cybercriminals will probably use the money to make other ransomware or do more criminal acts. You should try to decrypt as many files as possible using the test decryption service that is provided and wait to see if there is a solution available.

A full list of extensions that are encrypted by this ransomware virus is not available yet, but the following file types are reported to be encrypted by RotorCrypt ransomware:

→.csv, .doc, .ppt, .xls, .avi, .bak, .bmp, .dbf, .djvu, .docx, .exe, .flv, .gif, .jpeg, .jpg, .mdb, .sql, .mdf, .odt, .pdf, .png, .pps, .pptm, .pptx, .psd, .rar, .raw, .tif, .txt, .vob, .xlsb, .xlsx, .zip

All of the encrypted files will have the extension [email protected]____.c400 or [email protected]____.c400 appended to them. That is the only place where the contact email is given and why the ransomware may be called with these names among users. The extension .c400 is used in this variant.

The RotorCrypt ransomware is very likely to delete the Shadow Volume Copies of the Windows Operating System with the following command:

→vssadmin.exe delete shadows /all /Quiet

Continue reading to check in what ways you could try to restore some of your data. Kaspersky may have a possible solution in the form of a decryptor tool.

Remove RotorCrypt and Restore .c400 Files

If your computer got infected with the Rotor ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by RotorCrypt.

Note! Your computer system may be affected by RotorCrypt and other threats.
Scan Your PC with SpyHunter
SpyHunter is a powerful malware removal tool designed to help users with in-depth system security analysis, detection and removal of threats such as RotorCrypt.
Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter’s malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter’s EULA, Privacy Policy and Threat Assessment Criteria.

To remove RotorCrypt follow these steps:

1. Boot Your PC In Safe Mode to isolate and remove RotorCrypt files and objects
2. Find files created by RotorCrypt on your PC

Use SpyHunter to scan for malware and unwanted programs

3. Scan for malware and unwanted programs with SpyHunter Anti-Malware Tool
4. Try to Restore files encrypted by RotorCrypt

Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...