Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove Versiegelt Virus (Jigsaw) and Decrypt .versiegelt Files

stf-versiegelt-ransomware-virus-jigsaw-variant-german-ransom-message-note

The Versiegelt seems to be a German variant of the Jigsaw ransomware cryptovirus. All encrypted files will have the extension .versiegelt appended to them. The virus does not seem to have any particular theme as past variants do. The ransom price which is demanded by cybercriminals for decryption is 100 euros. To see how to remove this ransomware and how you can try to decrypt your files, read the article to the end.

Threat Summary

NameVersiegelt
TypeRansomware, Cryptovirus
Short DescriptionThe ransomware will encrypt your files and then display a ransom note demanding 100 euros for decryption.
SymptomsYour encrypted files will have the .versiegelt extension appended to each of them.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Versiegelt

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Versiegelt.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Versiegelt Virus – Distribution

The Versiegelt ransomware could penetrate your computer’s defenses in a number of ways. A payload file could be spread with the help of spam emails. Those emails are made in such a way that they sound important and try to trick you into opening the file attached to them. If you rush and do open the attachment, the malicious script inside it will get executed. Afterward, your computer machine will get infected. An example of such a file can be observed on the VirusTotal website:

stf-versiegelt-ransomware-virus-jigsaw-variant-virustotal-site-detections

Versiegelt ransomware could be distributed by using more methods. Its developers might be spreading the payload file further, around social media platforms or file-share networks. That malicious file could be presented as a useful program on one of those platforms by aiming to infect other potential victims. Right before opening a file, coming from a suspicious source, do a scan beforehand with a security program. Always check the signatures and size of such a file and see if they are strange in any way. You should read more tips on preventing ransomware in the corresponding forum topic.

Versiegelt Virus – In Depth

The Versiegelt cryptovirus seems to be a German version of the popular Jigsaw Ransomware. However, it doesn’t have a specific theme to it, like other variants of the ransomware, do. The virus will encrypt your files and then place the extension .versiegelt to every one of them. A lock screen will appear, right after the encryption process is complete, with the payment instructions written in the German language.

The Versiegelt ransomware can create entries in the Windows Registry when its payload is executed, to accomplish resilience. In case, these registry entries are set right and are active the virus will launch automatically with the booting of the Windows operating system. Afterward, your files will get encrypted, and the ransom message will display on your desktop screen.

This is how the screen with the ransom demands looks:

stf-versiegelt-ransomware-virus-jigsaw-variant-german-ransom-message-note

A QR code is present for quick accessability.

The ransom note written in German reads the following:

Ihre Daten sind verschlüsselt Der einzige Weg Sie wieder zu bekommen ist eine Zahlung von 100€ Sie zahlen an der unten genannten Bitcoin Adresse, wir prüfen die Zahlung und Entschlüsselt die Daten zu 100% danach sind wir Weg und kommen nicht mehr.

Es wird Ihnen keine Service Center Helfen können! Wenn Sie mit uns Kooperrieren halten wir unser Versprechen Zum Schluss löschen wir den Virus und Ihr Rechner funktioniert wieder wie vorher.

A rough English translation of the note:

Your data is encrypted
The only way to get it back is to pay 100 € you pay at the Bitcoin address below, we check the payment and decrypt the data to 100% after that we are gone and no longer visit.

No service centers will be able to help you! If you cooperate with us, we keep our promise. Finally, we delete the virus, and your computer will work again as before.

A Bitcoin address is provided to you with the demand of paying 100 euros in the Bitcoin currency. As past iterations of the ransomware were decryptable, it is highly possible that his one is too. You should NOT, in any circumstance, think of paying the cybercriminals. No one can guarantee you that by paying you will restore your files to the way they were. Additionally, the criminals will most likely use the money for making more ransomware viruses.

The Versiegelt ransomware could search to encrypt files with over than 120 various, different extensions. You can take a look at these extensions are, down below:

→.3dm, .3g2, .3gp, .aaf, .accdb, .aep, .aepx, .aet, .ai, .aif, .as, .as3, .asf, .asp, .asx, .avi, .bmp, .c, .class, .cpp, .cs, .csv, .dat, .db, .dbf, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .efx, .eps, .fla, .flv, .gif, .h, .pdb, .pdf, .php, .plb, .pmd, .png, .pot, .potm, .potx, .ppam, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .ps, .psd, .py, .ra, .raw, .rb, .rtf, .sdf, .ses, .sldm, .sldx, .sql, .svg, .swf, .tif, .txt, .vcf, .vob, .wav, .wma, .wmv, .wpd, .wps, .xla, .xlam, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xqx, .xqx, .idml, .iff, .indb, .indd, .indl, .indt, .inx, .jar, .java, .jpeg, .jpg, .js, .m3u, .m3u8, .m4u, .max, .mdb, .mid, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg

The .versiegelt extension will be appended to the end of the encrypted files’ names. The used encryption algorithm is still unknown.

The Versiegelt cryptovirus probably deletes the Shadow Volume Copies from the Windows operating system with the following command:

→vssadmin.exe delete shadows /all /Quiet

Continue to read to see what methods you can try to possibly decrypt some of your files.

Remove Versiegelt Virus and Decrypt .versiegelt Files

If your computer got infected with the Versiegelt ransomware, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by Versiegelt.

Manually delete Versiegelt from your computer

Note! Substantial notification about the Versiegelt threat: Manual removal of Versiegelt requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Versiegelt files and objects
2.Find malicious files created by Versiegelt on your PC

Automatically remove Versiegelt by downloading an advanced anti-malware program

1. Remove Versiegelt with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by Versiegelt
Optional: Using Alternative Anti-Malware Tools

Berta Bilbao

Berta is the Editor-in-Chief of SensorsTechForum. She is a dedicated malware researcher, dreaming for a more secure cyber space.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.