Scarab-Horsia Virus (Scarab Ransomware) – Remove and Restore Files

Scarab-Horsia Virus (Scarab Ransomware) – Remove and Restore Files

The Scarab-Horsia virus is the newest strain associated with the Scarab virus family. It uses the familiar tactics of blackmail and file encryption in order to coerce the victims into paying them for decryption. Our article gives further details on how victims can remove active infections.

Threat Summary

TypeRansomware, Cryptovirus
Short DescriptionThe ransomware encrypts sensitive information on your computer system with the extensions and demands a ransom to be paid to allegedly recover them.
SymptomsThe ransomware will encrypt your files with a strong encryption algorithm.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Scarab-Horsia


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Scarab-Horsia.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Scarab-Horsia Virus – Distribution Ways

Scarab-Horsia is a dangerous virus threat that can be distributed to victim users using various methods. The initial attack wave is limited in number and this does not give out details about the preferred infection method. It is presumed that they might use the most popular means.

An example is the creation and coordination of attacks using spam messages. They are sent in bulk and often contain social engineering elements that are usually taken from famous web sites and online services. Using these messages the hackers behind the Scarab-Horsia virus can either bundle the files or hyperlink them in the body contents. In connection with this several different type of payloads can be used.

One of the most common methods is of malware installers. They are hacker-modified versions of famous application such a system utilities, computer games and creativity suites. These threats are made by taking the original installer files and modifying them with the malware code.

The other way relies on infected documents that can take the form of any type: rich text documents, spreadsheets or presentations. When they are opened by the victims a notification prompt will appear that prompts them to enable the built-in scripts. If this is done then the virus will be downloaded from a remote location and executed on the local system.

The Scarab-Horsia can be distributed using browser hijacker. They are malware plugins made for the most popular web browsers (Mozilla Firefox, Google Chrome, Internet Explorer, Opera, Safari and Microsoft Edge). Once they are installed on the victim machines the users will be redirected to a malware site. The dangerous code changes settings such as the default home page, new tabs page and search engine. The next step is to infect the systems with the Scarab-Horsia virus.

Scarab-Horsia Virus – In-Depth Analysis

It is very possible that this threat has been developed by the original authors of the Scarab ransomware family. Another possibility is that the original Scarab source code has been acquired through the hacker underground communities and picked up by an individual hacker or criminal collective.

One of the first components that are launched once the virus has been deployed onto the victims is the information gathering component. It is used to gather sensitive information about the user and the system. The obtained information is usually classified into two categories. The first one is labeled as campaign metrics and is used primarily to judge how effective the attacks are. Example data includes details about the hardware components and certain operating system related strings. The second type of information refers to personal data. It can include anything from the victim’s name to their physical location. Sensitive credentials about their identity are revealed to the hackers: name, location, interests, passwords and account credentials.

The next step would be to use the gathered information with a stealth protection module. It can be used to bypass any security protection software such as anti-virus products, sandbox environments or debug software. In the case this isn’t possible the virus may automatically remove itself to avoid detection.

Infections with the Scarab-Horsia virus can incur various system changes. They can be changed according to the targets or the attack campaign itself. An example would be Windows Registry modifications that can cause certain applications or operating system services to fail. Overall performance may be affected as well.

If the threat is programmed to create a persistent state of execution then the Scarab-Horsia virus can also impact boot options. As a consequence the virus can disallow access to the recovery menu. Data recovery can be made difficult by deleting all the found Shadow Volume Copies of user data.

Scarab-Horsia Virus – Encryption Process

When all components have executed correctly the ransomware engine is started. The associated component uses a built-in list of target file type extensions. Example data includes:

  • Archives
  • Documents
  • Backups
  • Images
  • Videos
  • Music
  • Databases

All victim files are renamed with the extension. Depending on the configuration the original file names may also be renamed with a random string. A custom cipher is used which makes it very difficult to restore the files without the use of professional software.

A ransomware note is crafted in a file called HOW TO RECOVER ENCRYPTED FILES.TXT which contains the following contents:

/ __/ / / __ / / __ / / __/ / __/ / __ /
/ __ / / /_/ / / _/ /__ / _/ /_ / __ /
\/ __/ \___/ \/\__\ \___/ \___/ \/ __/
Your files are now encrypted!
Your personal identifier:
All your files have been encrypted due to a security problem with your PC.
Now you should send us email with your personal identifier.
This email will be as confirmation you are ready to pay for decryption key.
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.
Contact us using this email address:
If you don’t get a reply or if the email dies, then contact us to
Free decryption as guarantee!
Before paying you can send us up to 3 files for free decryption.
The total size of files must be less than 10Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.).
How to obtain Bitcoins?
* The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price:
* Also you can find other places to buy Bitcoins and beginners guide here:
* Do not rename encrypted files.
* Do not try to decrypt your data using third party software, it may cause permanent data loss.
* Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Remove Scarab-Horsia Virus and Restore .Scarab-Horsia Files

If your computer system got infected with the Scarab-Horsia ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.


Martin Beltov

Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.

More Posts - Website

Follow Me:
TwitterGoogle Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share