This is an article that provides specific details on a new strain of Matrix ransomware dubbed .THDA files virus. In it you will also find a step-by-step guide that could help you to go through the removal process of all malicious files that are running on the system. Since your data is of paramount importance we included alternative recovery approaches that could potentially restore .THDA files.
The crypto virus dubbed .THDA files virus belongs to Matrix family. Its infection files have been recently detected in the wild by security researchers. In case of infection with this threat it will plague predefined system settings in order to reach data encryption stage and corrupt valuable files. Then hackers will attempt to trick you into paying them a ransom for a supposedly working decryption key. Users around the globe could be affected by this .THDA ransomware virus.
|Name||.THDA Files Virus|
|Short Description||A data locker ransomware that utilizes combination of two sophisticated cipher algorithms to encrypt valuable files stored on devices it infects and demands a rransom payment.|
|Symptoms||Important files are corrupted and renamed with .THDA extension. Ransom note appears on screen to extors a ransom payment.|
|Distribution Method||Spam Emails, Email Attachments, Corrupted Web Pages|
|Detection Tool|| See If Your System Has Been Affected by .THDA Files Virus |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss .THDA Files Virus.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
.THDA Files Virus – Distribution
.THDA files virus is triggered on target systems by its payload. For the distribution of this file hackers could utilize various shady techniques. All techniques aim to trick you into starting the payload on your PC without suspecting that it will infect it with ransomware.
The main spread technique is believed to be malwspam. It enables bad actors to send email messages that pretend to be sent by legitimate sources like internet providers, banking institutions, popular websites, delivery companies and even governmental institutions.
The senders of these emails may pose as representatives of the above-mentioned services in an attempt to make you more prone to follow the instructions provided by the text messages. The text messages usually contain strong call-to-action that urges you to review the content of an attached file or a presented link as soon as possible. In case that you fall victim to their scam, you unnoticeably grant the ransomware access to your system.
For the sake of your security, whenever you run across a dubious file you could use a free online file extractor and malware scanner to check the security level of the file before you open it on your PC. As the scan results will display you details about the security of uploaded files they may help you to refrain from opening malicious files on your PC.
.THDA Files Virus – Infection Stages
As identified by security researchers the so-called .THDA files virus belongs to Matrix ransomware family.
In the beginning of the infection process .THDA Matrix ransomware establishes all needed malicious files on the affected system. For the purpose, it could either create some files directly on the system or drop them from a contacted command and control server. Тhere are several folders that are likely to store these files:
Afterward the code of the initial payload could trigger predefined commands that execute malicious files in an exact order. The sequence of malicious actions enables the ransomware to plague essential system components and complete its attack. What’s more some of its associated files may be configured to manipulate functionalities of legitimate processes in order to keep the ransomware undetected by active security measures.
Soon after the ransomware completes system and data modifications it drops a ransom note file called !README_THDA!.rtf in one or several folders. The text presented by this message reveals you the presence of the ransomware and blackmails you into paying hackers certain ransom for a decryption solution.
.THDA Files Virus – Encryption Process
The .THDA crypto virus was identified to belong to the Matric ransomware family. Being a strain of this family it is likely to apply a combination of two sophisticated cipher algorithms (AES-128 + RSA-2048) to encrypt target types of files.
During this process the ransomware transforms parts of the original code of target files in order to restrict the access to the data they store. Unfortunately, an infection with this crypto virus could lead to the corruption of valuable files including but not limiting to your:
- Audio files
- Video files
- Document files
- Image files
- Backup files
- Banking credentials, etc
Upon encryption, all corrupted files appear with the extension .THDA. The encryption process is associated with the generation of the unique decryption key that is supposedly able to recover encrypted files. However, you should not believe hackers as they could trick you again by sending you a broken decryption key that won’t decrypt your .THDA files.
Remove .THDA Files Virus and Restore Data
Below you could find how a step-by-step removal guide that could be helpful in attempting to remove .THDA crypto virus. Since the manual removal approach demands a bit of technical knowledge and experience with recognizing malicious traits, the guide provides an automatic approach as well. Beware that ransomware is a threat with highly complex code that plagues not only your files but your whole system which in turn limits its regular and secure usage. So let’s begin with the removal..
Unfortunately, at this point, there is no evidence of any free decryption tool that works for this .THDA Matrix ransomware. The good news is that there are some alternative data recovery methods that may be helpful in restoring .THDA files. So make sure to get familiar with the details listed under our “Restore Files” step. Beware that before the beginning of a recovery process you should back up all encrypted files to an external drive and this way prevent their irreversible loss.