Remove RotorCrypt Ransomware and Restore .c400 Files - How to, Technology and PC Security Forum |

Remove RotorCrypt Ransomware and Restore .c400 Files


RotorCrypt is the new name of the previously known Rotor cryptovirus. The virus is also ransomware as its past iteration. After the encryption of your files, the extension .c400 will be appended to them along with one of two emails. The emails are and To see how to remove the virus and how you can try to restore your encrypted files, read the whole article.

Threat Summary

TypeRansomware, Cryptovirus
Short DescriptionThe virus will encrypt your files and demand a ransom as payment for their decryption.
SymptomsThe ransomware appends the .c400 extension to encrypted files. It asks for payment in Bitcoins to the and email addresses.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by RotorCrypt


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss RotorCrypt.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

RotorCrypt Ransomware – Update February 2018

Update! A decryption tool is now available for the RotorCrypt ransomware! The tool was created by malware researchers from Kaspersky and can be downloaded from the following link, wrapped inside a .zip archive: Rakhni Decryption Tool.

RotorCrypt Ransomware – Delivery

The RotorCrypt ransomware could be delivered to your computer using different ways. Its payload file could be spread with spam email campaigns. With these emails, the file could be attached and made to look as important. The entirety of the email may look legitimate and try to trick you that you need to open the attachment because its full contents cannot be conveyed in the email body. However, if you open that file, your computer becomes infected. The file can be heavily obfuscated and is in most cases an executable.


From the analysis report shown above, you can view that on the VirusTotal site, the file is named Trojan-Ransom.Win32.Rotor.b as some of the detections. The developers of this ransomware could be delivering the file with targeted attacks or through sharing services and social media. Do not be opening executables from suspicious emails, especially if they are of unknown origins. Scan these files with a security tool and check their signatures and size, beforehand. You should take a look at the ransomware prevention tips in our forum topic.

RotorCrypt Ransomware – Description

RotorCrypt ransomware is discovered to be a new variant of the Rotor Virus (cocoslim98). Now, it uses new executables to spread its malicious files. You can view in the Payload Security platform, the detection of one such executable file is called GWWABPFL.exe:


When the payload file of the RotorCrypt virus is executed on a computer, it spawns lots of processes, according to the malware researchers of Payload Security. The virus is still mainly orientated around targeting servers, although many Windows machines have been infected, too.

When RotorCrypt is active, it could set up values in the Windows Registry, whereupon it gains persistence. The values are set inside entries of that registry and make the ransomware launch automatically with every boot of the Windows operating system. Afterward, files get encrypted, and a tiny note with the payment instructions is created. You can view that ransom note in the screenshot right here:


The ransom note reads the following:

Good day

Your files were encrypted/locked
As evidence can decrypt file 1 to 3 1-30MB
The price of the transcripts of all the files on the server: 7 Bitcoin

Recommend to solve the problem quickly and not to delay

Also give advice on how to protect Your server against threats from the network

(Files sql mdf backup decryption strictly after payment)!

The RotorCrypt ransomware does not give you any specific deadline for paying the criminals for the data decryption process. It also makes the offer of free decryption for a couple of files as a testing procedure. Nonetheless, its demands are high with the ransom amount which is demanded and that the decryption of some files will be only available after payment. The ransom price that is asked is 7 Bitcoins, and that amounts to over 4400 US dollars.

You shouldn’t think of paying these extortionists, as no one can guarantee that you will return your files to what they were after payment. The cybercriminals will probably use the money to make other ransomware or do more criminal acts. You should try to decrypt as many files as possible using the test decryption service that is provided and wait to see if there is a solution available.

A full list of extensions that are encrypted by this ransomware virus is not available yet, but the following file types are reported to be encrypted by RotorCrypt ransomware:

→.csv, .doc, .ppt, .xls, .avi, .bak, .bmp, .dbf, .djvu, .docx, .exe, .flv, .gif, .jpeg, .jpg, .mdb, .sql, .mdf, .odt, .pdf, .png, .pps, .pptm, .pptx, .psd, .rar, .raw, .tif, .txt, .vob, .xlsb, .xlsx, .zip

All of the encrypted files will have the extension !____elizabeth7@protonmail.com____.c400 or !____likbez77777@gmail.com____.c400 appended to them. That is the only place where the contact email is given and why the ransomware may be called with these names among users. The extension .c400 is used in this variant.

The RotorCrypt ransomware is very likely to delete the Shadow Volume Copies of the Windows Operating System with the following command:

→vssadmin.exe delete shadows /all /Quiet

Continue reading to check in what ways you could try to restore some of your data. Kaspersky may have a possible solution in the form of a decryptor tool.

Remove RotorCrypt and Restore .c400 Files

If your computer got infected with the Rotor ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by RotorCrypt.


Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share