A virus from the file encryption type has been reported by malware researchers to attack Russian-speaking users. The ransomware infection performs multiple different activities on the compromised computers. The malware is dubbed RozaLocker and drops a ReadMe.txt file after it infects a computer. The .txt file has a ransom note with demands to pay the sum of 10000 rubles which is approximately 170 US dollars. The cyber-criminals promise that after they receive a payment, they will decrypt the files, but it is strongly advisable not to make any payoff and instead read the following article carefully.
.enc File Virus
|Short Description||This ransomware infection encrypts files on the compromised computer and asks the user to pay approximaely 170$ for the file recovery.|
|Symptoms||The user may witness ransom note, named ReadMe.txt and the important files on the computer may be encrypted.|
|Detection Tool|| See If Your System Has Been Affected by .enc File Virus |
Malware Removal Tool
|User Experience||Join our forum to Discuss .enc File Virus.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
RozaLocker Ransomware – How Does It Infect
For the infection procedure, the virus may undertake a massive e-mail spam campaign, oriented towards Russian-speaking users. What is particularly interesting in this situation is that the RozaLocker threat may sent the spam messages with deceitful messages within them. Amongst the deceptive templates may be included claims the user has purchased something online and even claims that there is suspicious activity on his or hers paypal or bank account. The end goal of those e-mails is to open the e-mail attachments that cause the actual infection with RozaLocker. The e-mails sent may appear like the example image below:
But this is not the only infection method that may exist when it comes to this particular ransomware. It may also be uploaded in a hacked account of uploaders on torrent websites. Since accounts on these sites have usually a high rate of infection, reports often indicate that these accounts are hacked and malicious infectors may be uploaded through them. The infection files may pretend to be game patches, cracks and other fake installers, users believe are legitimate.
RozaLocker .enc Variant – Infection Activity
When a malicious file carrying the download script or RozaLocker has been activated, the virus may connect to a remote host. This is done with the one and only purpose of downloading the payload of RozaLocker and dropping the malicious files which later render most of the usable data no longer openable. The malicious payload dropped, may consist of the following files:
- A setup.exe file with malicious scripts in it which may be the encryption module.
- A ReadMe.txt ransom note of RozaLocker which has the payoff demands.
- A qt_temp.Hp module.
- A trainer.exe file which displays a pop-up.
Both the qt_temp and trainer file are located in the Windows directory. Other files may be scattered in numerous other folders:
- %System Drive%
Once the virus is ran on the computer, it asks the user from Windows Smart Screen to run the setup.exe file. In the event that the user is inexperienced enough and activates the setup.exe file, the virus displays a pop-up translating to “Game program from Sashi The Renderer”.
RozaLocker – The Encryption Procedure
The encryption process of RozaLocker involves altering the data of original files with symbols from the encryption algorithm used by the ransomware. The usually targeted files by RozaLocker may be Microsoft Office documents, image files, Adobe Reader files, music, videos and other files that may be of importance to the victim. If we have to sum it up, the virus may encrypt files that are often used, like the following file types:
→ “PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”Source:fileinfo.com
After the encryption procedure has been completed, the encrypted files are rendered no longer able to be opened. They are also appended the .enc file extension after their original one and may look like the following image:
After the encryption process has completed, this ransomware virus also drops it’s ransom note which roughly translates to:
“YOUR FILES are encrypted (EVEN NOT LOOKING THAT THEY ARE PARTIALLY OPEN). WE HAVE YOUR LOGIN AND PASSWORD FROM THE ENTERTAINMENT, ONE-CLASSICS, ONLINE BANKS AND OTHERS.
YOU HAVE 6 HOURS TO PAY FOR A PURCHASE FOR THEM, OTHERWISE WE SHOULD PUT INTO OPEN ACCESS!
1) Find 10 000 (10 thousand) rubles, not less. Suitable for the following –
(Qiwi, Sberbank, Yandex.Money, Tinkoff Bank, VTB, but better Qiwi (faster)
2) In the browser, open the site https://x-pay.cc/ – through this site you will transfer money
3) In the column I DELETE where you will translate (according to item 1) and above enter the amount – 10,000 rubles.
4) In the RIGHT I select Bitcoin and on top the amount should automatically be transferred to btc
5) In the column DATA ENTRY, fill in your requisites from where you will pay and where to transfer (Bitcoin wallet)
ATTENTION-ATTENTION, CORRECTly copy this number to a purse (yes, it’s so strange)
After inserting, carefully, again check whether it is copied correctly.
6) Click on GO TO PAY and follow the instructions on the site.
In a couple of hours we’ll write you on the desktop and return everything to you.
If there are difficulties, then write on the mailbox – email@example.com”
Remove RozaLocker Ransomware and Try Getting Back .enc Files
Before attempting any removal of RozaLocker ransomware, recommendations are to back up the encrypted files before the actual removal takes place, just In case.
Then, for the removal process, we advise you to follow the removal instructions below. But in case you lack the experience and feel uncertain that you will fix all infected objects and remove the malicious ones manually, recommendations are to remove this ransomware infection automatically. One way to do this is via an advanced anti-malware software which will automatically remove RozaLocker ransomware and protect you from such threats in the future too,
For the file recovery of .enc files, encrypted by this virus, at the moment there is no direct free solution. However, paying the ransom is also highly inadvisable because it may not result in you getting your files back. This is why we recommend checking out some alternative methods that can recover a portion of your files. They are published in step “2. Restore files encrypted by .enc File Virus” and are no guarantee you will get all your data back, but you may get back at least a part of it.