.sifreli File Virus - Remove and Restore Encrypted Files

.sifreli File Virus – Remove and Restore Encrypted Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)


This article contributes to removing .siferi file virus from infected machines and restoring corrupted files.

The .sifreli file virus is a malware of ransomware type. Ransomware is computer infection that utilizes strong cipher algorithms to modify original code of particular data leaving it completely unworkable until a ransom is paid to cyber criminals. The name of this specific data locker ransomware derives from the malicious file extension it appends to each corrupted file – .sifreli. Another trait of .sifreli file virus is a ransom note file called !!! SISTEMINIZ HACKLENDI !!! that is dropped and displayed on the PC screen. At this point, it seems that the ransomware is targeting Turkish speaking users which does not exclude its distribution worldwide.

Threat Summary

Name.sifreli File Virus
Short DescriptionThe ransomware encrypts valuable files on your computer and displays a ransom message afterward.
SymptomsThe ransomware will encrypt your files, show up a ransom message and demand a ransom payment for file recovery.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by .sifreli File Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .sifreli File Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.sifreli Ransomware – Delivery

The ransomware infection can be triggered only by single file once it is running on the system. However, this file is usually distributed being embedded or hidden in other files like zip archives, documents, PDFs and other. Such malicious files can be attached to emails or send via social media channels. Hackers like to use email addresses and subjects that will entice you to read the email and open the attachment. Once you do it, the corrupted file will deliver the ransomware. The malicious ransomware payload may also be injected into the code of web pages and then spread as links to those pages. These sites may be cologne versions of well-known websites of agencies and services like a local mobile telephone operator, your bank, and online stores. Again phishing emails and social media channels, as well as online advertisements, are likely to be used for distribution of corrupted links.

.sifreli File Virus – Detailed Overview

The word “sifreli” is Turkish and means encrypted in English and that is also the extension used by the ransomware for the encrypted files. The infection begins when the ransomware payload is running on the system. As .sifreli file virus is believed to be programmed to perform various malicious activities, it is possible to drop and create additional malware files in following Windows folders:

  • %Temp%
  • %Roaming%
  • %UserProfile%
  • %AppData%

The threat may spawn various processes in order to remain undetected by installed security tools during the encryption process. The removal process may be a tricky task as .sifreli ransomware has the functionality to create new values in Windows Registry to ensure its permanent presence on the system. Registry keys Run and RunOnce probably have added malicious values that allow the ransomware to display its ransom message once it encrypts files.

The message is written in Turkish and is being displayed as an annoying pop-up window, which is not possible to be closed. Below you can see the full message:

Ben sistem açıklarını araştırıp bulan ve bu şekilde para kazanan bir sistem mühendisiyim. Şirketinizin sistemlerinde bir açık buldum ve sisteminizi hackledim. Şirketinizle ilgili bütün bilgilerinizi ele geçirdim ve sisteminizdeki ayrıca ağınızdaki tüm verileri şifreledim. Şayet bu bilgileri geri almak isterseniz ve şifreyi sabrı almak için benimle iletişime geçiniz..
e-mail: muhendis@mail.ua
Aksi taktirde ele geçirilen bilgiler internet ortamında yayınlanacaktır.
Encrypted Session Key: A7198E 24182288171396F8C 85 F228D4C FD1014E F4E 06 F8589F5236ADE D28E 34F4574838 L F61CF9352ADE55777539007D62729A7B8CF 1700154E 070056E 786746413ABF829508C4F


With the help of an automated translator it becomes clear that in English .sifreli crypto virus informs its victims the following:

I am a system engineer who searches for system exploits and earns money in this way. I found an open in your company’s systems, and I hacked your system. I’ve got all your information about your company, and I’ve also encrypted all the data on your system. If you want to get this information back, and you get the patience, please contact me.
E-mail: muhendis@mail.ua
Otherwise, the captured information will be published on the internet.
Encrypted Session Key: A7198E 24182288171396F8C 85 F228D4C FD1014E F4E 06 F8589F5236ADE D28E 34F4574838 L F61CF9352ADE55777539007D62729A7B8CF 1700154E 070056E 786746413ABF829508C4F

The ransomware creator doesn’t state what the ransom amount is but only provides email for contact. For the sake of your security, it is better to avoid contacting the bad guy at muhendis@mail.ua and proceed with the ransomware solution by reading the article to the end.

.sifreli File Virus – Data Encryption

As .sifreli file virus is a data locker ransomware, its primary purpose is to corrupt files stored on the infected computer. Basically, this threat targets files that are likely to contain personal information for which you may be willing to pay money. Thus, all your documents, photos, images, projects, archives, music, videos, text files, and databases are likely to be encrypted and renamed with the malicious file extension .sifreli. The encryption is believed to be performed via strong cipher algorithms like AES and RSA so data cannot be decrypted that easy. However, security experts are currently analyzing .sifreli ransomware samples and hopefully, they will crack its code and release freely available decryptor. Meanwhile, once you remove all malicious files created on the PC by the ransomware and backup all encrypted files you can try the help of alternative data recovery solutions. In step Restore files encrypted by .sifreli file virus from our full removal and recovery instructions you can find more information on data restore process.

Remove .sifreli File Virus and Restore Files

Considering all devastating consequences after .sifreli ransomware infection, there is no doubt that all files and objects associated with the threat should be removed as soon as possible. Otherwise, your system remains extremely vulnerable and each new file will be encrypted at the moment you create it. The removal process is explained in a step-by-step guide below, and for best results, security experts recommend the help of anti-malware tool.

Gergana Ivanova

Gergana Ivanova

Gergana has completed a bachelor degree in Marketing from the University of National and World Economy. She has been with the STF team for three years, researching malware and reporting on the latest infections.

More Posts

Follow Me:
Google Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share