Rontok Ransomware — How to Remove It

Rontok Ransomware — How to Remove It

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

This article will aid you to remove Rontok Ransomware. Follow the ransomware removal instructions provided at the end of the article.

Rontok Ransomware is one that encrypts your personal data with a strong cipher and demands money as a ransom to get it restored. The Rontok Ransomware will leave ransomware instructions as text file. Keep on reading the article and see how you could try to potentially recover some of your locked files and data.

Threat Summary

NameRontok Ransomware
TypeRansomware, Cryptovirus
Short DescriptionThe ransomware encrypts sensitive user files on your computer system and demands a ransom to be paid to allegedly recover them.
SymptomsThe ransomware will encrypt your files and leave a ransom note with payment instructions.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Rontok Ransomware


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Rontok Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Rontok Ransomware – Distribution Techniques

The Rontok ransomware is a hybrid virus that targets both Linux servers and can effectively take down Windows machines as well. It is spread using unknown methods as the collected samples are relatively low in number. There are a variety of distribution methods that will deliver the virus files to the target systems. Direct attacks can be done by using vulnerability testing. This is done by utilizing a software that will automatically search for weaknesses which will be exploited if found.

The criminals can attempt to infect the target computer users by crafting email SPAM messages which are sent to their inboxes. By using social engineering tactics the victims will be coerced into thinking that they have received a legitimate message from a well-known company or service. The criminals will use the same body elements as legitimate and well-known sources in order to fool the recipients into thinking that they are receiving a real notification. In the body contents the virus files can be linked or they can be directly attached.

Alternatively the hackers can create malicious web sites which are used to confuse the visitors into thinking that they are visiting legitimate and safe addresses. They can be download portals, search engines, product landing pages and etc. In some cases the pages can even include stolen or hacker-generated security certificates and similar sounding domain names.

The associated Rontok ransomware samples can be uploaded to file-sharing networks such as BitTorrent where both pirate and legitimate files can be shared. They may also be embedded in payload carriers of which there are two popular types:

  • Infected Documents — The hackers can produce documents containing dangerous virus code that will deliver the Rontok ransomare infection. They are placed in the macros which can be embedded across all popular types: presentations, databases, text files and spreadsheets. When they are opened by the victims a prompt will be spawned asking the users to enable the built-in code in order to correctly “view” the documents.
  • Setup Files — The criminals can create dangerous application installers of popular products which are positioned as safe and legitimate. This is done by taking the real files and inserting the necessary code into them. Usually the criminals will use applications that are popular with end users: creativity suites, productivity and office apps, graphics software, system utilities and etc.

Alongside these methods the criminals can also embed the virus installation code in malicious web browser extensions, alternatively known as hijackers —they are usually uploaded to the relevant repositories using fake or stolen developer credentials and user reviews. Their descriptions will offer promises of improvements such as new features addition or performance optimizations. At the same time modifications to the browser settings can be done in order to redirect the victims to a hacker-set portal page. Values that are changed include the default home page, search engine and new tabs page.

Rontok Ransomware – Detailed Analysis

The Rontok ransomware is designed to infiltrate Linux servers and it can also be configured to affect the machines as soon as the infection is made. We have received reports that indicate that the engine will search for an active web server. This is done in order to find the relevant public_html folder which contains all of the web site content which is delivered to the visitors. This is done in order to display the ransomware note to everyone who visits the web server of the infected machines. This is an act of defacement, a type of sabotage.

This behavior shows that there are some modules that are made part of the installation:

  • Information Gathering — The Rontok ransomware engine is programmed to interactively scan the compromised machines and search for specific information. In most cases this involves machine identification metrics which are composed of strings such as the installed hardware components, users preferences and system settings. The same engine can additionally be used to extract data that can directly reveal victim information that can automatically lead to the exposure of their identity. This is done by making the engine search for strings such as a person’s name, address, phone number, interests and account credentials.
  • Security Software Bypass — The Rontok malware engine can be configured to search for security software that can effectively block the normal functioning of Rontok. This includes all kinds of anti-virus products, firewalls, intrusion detection systems, sandbox/debug environments and virtual machine hosts.
  • Persistent Installation — The Rontok ransomware can be installed in a way which will automatically launch the infection as soon as the computer has started booting. In addition it may block access to the recovery boot options and system restore menus. This is rated as a dangerous action as many manual user removal guides depend on access to them.
  • Data Removal — The engine can search for sensitive data that will be automatically removed when found: system backups, restore points and shadow volume copies.

We anticipate that the hackers will probably modify the behavior patterns during the campaign execution in order to find out which will be the most effective method of intrusion.

As the virus primarily targets web servers it is very possible that cryptocurrecny miners can be a part of the infection. They represent malicious scripts which will start a process on the infected server that will run complex mathematical operations. They will take advantage of the installed hardware resources (CPU, GPU, memory and hard disk space) in order to compute them. Whenever one of the tasks has finished running it will reward the hacker controllers with digital currency.

The alternative name of the Rontok threat is Borontok ransomware.

Rontok Ransomware – Encryption Process

The Rontok Ransomware will launch the relevant encryption operations when all modules have finished running. Like other similar threats it will use a built-in list of target file type extensions such as the following:

  • Backups
  • Archives
  • Databases
  • Images
  • Music
  • Videos

All affected file will assigned the .rontok extension and encoded with the base64 algorithm.

Remove Rontok Ransomware and Try to Restore Data

If your computer system got infected with the Rontok ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.


Martin Beltov

Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.

More Posts - Website

Follow Me:
TwitterGoogle Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share