Al-Namrood ransomware / virus (updated Apr 2017) - Virus Removal Instructions

What is Al-Namrood ransomware virus?

New versions of Al-Namrood virus strike victims in 2017

When Al-Namrood virus appeared on the Internet, few might have expected that it will remain long in the competitive race among ransomware creators. Hackers tend to name ransomware according to their interests, and this time they chose to denominate their virus using Saudi-Arabian black metal music band’s name^[1]. There have been already several cases of similar file-encrypting viruses: Batman_good@aol.com, NoobCrypt, or Jigsaw ransomware. Speaking of Al-Namrood ransomware origins, it is believed to be developed by the same ransomware gang that created all Apocalypse ransomware variants. There are a couple of versions that were originated from Al-Namrood initial version, for example, Al-Namrood 2.0, also versions that hardly differ from each other but provide different contact details. For example, one ransomware suggested contacting criminals via Jabber XMPP messaging service – cryptservice@jabber.ua, decryptgroup@xmpp.jp also email addresses – decryptioncompany@inbox.ru, fabianwosar@inbox.ru, decryptgroup@india.com. Therefore, each new ransomware possesses more complex features making the threat more invincible. However, if this cyber menace has befallen you, no need to panic as you can remove Al-Namrood quickly. We recommend speeding up the procedure with FortectIntego. Before you run any malware removal programs, check out Al-Namrood removal instructions given below this post.

Following the tradition of typical file-encrypting malware, the current virus is suspected of using the same channels of distribution. Once it successfully infiltrates the device ^[2], it starts sneakily looking for a broad range of files. It tends to corrupt files with these file extensions:

1cd, dbf, dt, cf, cfu, mxl, epf, kdbx, erf, vrp, grs, geo, st, pff, mft, efd, 3dm, 3ds, rib, ma, sldasm, sldprt, max, blend, lwo, lws, m3d, mb, obj, x, x3d, movie.byu, c4d, fbx, dgn, dwg, 4db, 4dl, 4mp, abs, accdb, accdc, accde, accdr, accdt, accdw, accft, adn, a3d, adp, aft, ahd, alf, ask, awdb, azz, bdb, bib, bnd, bok, btr, bak, backup, cdb, ckp dsk, dsn, dta, dtsx, dxl, eco, ecx, edb, emd, eql, fcd, fdb, fic, fid, fil, fm5, fmp, fmp12, fmpsl, fol, fp3, fp4, fp5, fp7, fpt, fpt, fzb, fzv, gdb, gwi, hdb, his, ib.

Researcher shows the ransom note left by Al-Namrood ransomware.

Therefore all your valuable documents, audio, video and image files are threatened by this virtual menace. With the help of traditionally employed AES encryption algorithm, the ransomware quietly encodes the files. As a result, you cannot access them, and you might spot that they bear one of the following extensions: .namrood, .access_denied, .unavailable, .disappeared. As usual in the ransom note, which can be dubbed Read_Me.txt or Decrypt_me.txt, cyber criminals instruct victims to pay the money in exchange of their locked data. However, we do not recommend paying any money to cyber criminals, at least not until you try Al-Namrood decryption tools created by malware analysts. Paying the ransom should be the very last option when dealing against ransomware attack, and only if losing the files lead to disastrous consequences at work or elsewhere. Remember that cybercriminals do not even have to provide you with the decryption software – it’s up to them, and the fact that you paid the ransom doesn’t really evoke sense of mercy for them.

Update December 2016: new version makes an appearance

Al-Namrood 2.0 ransomware virus struck the virtual world quite recently. It follows the manner of its predecessor to lock your personal data with AES-256 algorithm ^[3]. The essence of this encryption technique lies in running several cycles of block ciphers. Therefore, even a change of one number results in a completely different decryption key. Crooks take an advantage of this feature and threaten the victims to pay 10 BTC which equal to 6000 USD ^[4]. Such ridiculous demanded amount of money should ward off any considerations to transfer the money. The crooks indicate email – decryptgroup@xmpp.jp – for public communication purposes. However, it is futile to hope that you will return the files even if you dear to pay 10 bitcoints. Proceed to the elimination steps.

Update April 2017: Al-Namrood 2.0 virus uses different email, new attack vectors expected

Al-Namrood isn’t one of the most prominent viruses so far, however, it slowly evolves and every now an then we notice new versions of it. Recently, our experts spotted a ransomware that was dubbed Crypt32@mail.ru virus. Samples of this malware were spotted in April, and they were adding a long string to filenames of encrypted data. Here is an example of what the name of the encrypted file consists of [original_filename].ID-[8 random characters+victim’s country code[Crypt32@mail.ru].[14 random characters]. Apparently, the ransomware injects the contact email address in the new file extension and also corrupts the original filename. Just like the previous version, this one spreads via RDP attacks and spam. However, considering that ransomware distributors managed to hijack ad networks and push malware to victims via popular software such as Skype lately^[5] (see – Skype virus), we strongly recommend users to be careful and not to click on suspicious ads that pop up in front of your eyes as you browse the Internet. Be extremely cautious and do not agree to install shady software updates, because that’s how ransomware distributors tricked dozens of victims into installing ransomware on their computers lately^[6].

Ways of distribution

Al-Namrood malware follows the tradition of other notorious ransomware which confirmed their status in the cyber world, therefore it spreads using traditional techniques such as spam, malvertising, and others such as RDP attacks (it tends to target servers that have remote desktop services enabled). If you’re familiar with RDP services, make sure you use strong password for them, keep all your software up-to-date and ideally, create data backups every once in a while.

Speaking of spam, we must say that hackers might be using users‘ personal data acquired from fraudulent browser hijackers and adware to address victims directly. Clearly, spotting an email with your name mentioned in it instantly boosts up your curiosity. However, reviewing the infected attachment might open the Pandora box: you might accidentally activate not only Al-Namrood hijack but also allow various smaller viruses to enter the device. In this case, exercise caution and attention while surfing through your emails. You can always verify the sender on your own by calling the company that the email allegedly comes from, or look for information about the sender online using search engines.

How quickly can I get rid of Al-Namrood ransomware?

When it comes to this malware, we encourage victims to save time and shift to automatic Al-Namrood removal. You can perform it with the help of FortectIntego or Malwarebytes. Either one of another utility will help you battle the ransomware and completely eradicate it. Only when you remove Al-Namrood virus completely, you can think about the possible options of data recovery. In this regard, you can use our recommendations. Lastly, avoid using torrent sharing websites as they happen to be a frequent haven of file-encrypting malware. In addition, avoid opening the spam attachments if you are not sure if the email is fake or the real one. Reviewing new applications‘ reviews might come in handy before installing them as well.