VenusLocker stoped working as ransomware and started mining Monero
VenusLocker – malicious ransomware virus that was created on the basis of EDA2 ransomware and was initially released for educational purposes. However, according to the latest reports, it has already stopped asking ransoms. To generate income, VenusLocker has recently started mining Monero.[1] This is a completely new tendency that may become common in 2018.
VenusLocker started its activity as the educational program used to help users learn the main dangers related to ransomware. However, soon after its release, the virus was set to perform malicious activities on victims’ computers.[2] After these changes, it started using .venus file extension to mark affected data.
In fact, it is not the first case when educational programs start working as evil apps. For instance, Hidden Tear ransomware has also received some dangerous follow-ups including Magic ransomware, Linux.Encoder[3] and Ransom_Cryptear.B.[4] Venus Locker appeared on the ransomware market not that long ago, but it has already managed to affect hundreds of computers worldwide.
This program uses AES and RSA-2048 encryption keys to lock the files, making them virtually inaccessible. After the encryption, VenusLocker malware claims “You are hacked” and asks the victims to pay a set amount of money if they want to see their files ever again. Though the sum the hackers ask for is relatively small (1 BTC), paying up is the last thing you should do.
It is much wiser and safer to remove VenusLocker from the infected computer rather than try buying out your data from the unreliable criminals. Professional antivirus utilities, such as FortectIntego can assist you with the virus elimination. Otherwise, you can be left with no money and no files.[5] 
As we have already mentioned, VenusLocker creators have recently started mining Monero cryptocurrency. The first example was noticed in South Korea but there is a huge possibility that the virus will show up in other world's countries as well.
Systems are infected using various social engineering schemes, for example, informing users that their personal photos were abused and that they need to double check them to stop their distribution. Once the victim downloads this “photo”, Monero Miner starts working behind user's back.
If you got infected with VenusLocker that offers you to buy the private data decryption key for the encryption of your files, you should never buy it. Keep in mind that your are dealing with cyber criminals who can easily fail to send you the required decryption key. Besides, they can easily use the revenue to create even more malicious computer infections.[6]
To avoid these consequences, take care of VenusLocker removal first instead of paying up. Then, do not panic and follow data recovery tips provided in the end of this post.
February 2017 Update: Korean malware joins up VenusLocker
Thanks to John Lambart, the virtual community was notified of the Korean virus which distributes an updated version of VenusLocker ransomware. While “English” ransomware viruses dominate in the crypto-malware market, recent news reveals that cyber villains of other nationalities are making a move as well. The virus researcher notifies netizens to beware of the malware which is written in the Korean language.
Surprisingly, it is the same distribution technique employed by Locky and Cerber ransomware. The improved version disguises in the Korean malware which asks victims to enable macros. Interestingly, that the developers of this virus simplified the task of making the required modification. Targeted users only have to click CTRL+A and change the font of the text to execute the infection.
As a result, the risk to execute the infection greatly boosts up. Note that there have been detected English versions of this update as well. Pay close attention not to enter this command accidentally. The new version of Venus Locker spreads via spam message in the form of fake invoices and other seemingly important notifications.
Ransomware prevention
VenusLocker is currently still undecryptable which means that there is no way to unlock the files affected by this virus other than paying the ransom. We want to emphasize again, that for the sake of your future files and the balance of your bank account it is safer to get rid of the infection as soon as possible. However, even after the virus is removed you will have encrypted data to deal with.
If you did not have any backup copies of your files saved on external drives before the infection, the possibility of successfully recovering your data is very low. You may try out alternative data recovery solutions but do not put too much hope to them.
As you have already understood, the best way to protect your files is to make copies and keep them on separate external storage drives. Please note that your USB, external hard drive or other storage devices should be unplugged from the computer when not in use. Otherwise, the virus may infect these drives as well and you may lose your important information completely.
Removing VenusLocker – mission possible?
A thing to remember about the ransomware viruses is that these infections are not that easy to get rid of. If you are non-professional, we do not recommend taking actions against this virus yourself.
You can only use the manual VenusLocker removal approach in case the virus is blocking your antivirus from running, and the full system scan cannot initiate. These instructions are provided below the article.
When you complete these steps, it is crucial that you run the virus-fighting utility again to remove VenusLocker virus from your computer completely.
Was this guide helpful?
3 comments