Aims of Joker_lucker@aol.com.wallet virus
Joker_lucker@aol.com.wallet virus is the most recent Dharma ransomware variation, also known as undecryptable CrySiS remake. Recently IT specialists have released a decryption tool for the original version of Dharma threat[1]. This virus is programmed to scan system folders and distort files found in them. To implement this, Joker_lucker@aol.com.wallet ransomware applies a strong AES + RSA encryption method[2] that securely locks files on victim’s computer. During this process, the virus adds either one or another file extension to encrypted files:
- Joker_lucker@aol.com.wallet;
- Joker_lucker@aol.com.dharma.
The worst part is that .dharma or .wallet files cannot be opened without a special decryption key that is created after data encryption and sent to criminals Command & Control servers. There is no way to get this decryption key without criminals’ intervention, but these scammers are not willing to provide it for free. That is why the virus changes desktop wallpaper with an image that informs the victim to contact criminals via Joker_lucker@aol.com (in some cases – lavandos@dr.com) for information on how to obtain the decryption key. There are no doubts what cyber criminals want victims to do. Just like the vast majority of ransomware viruses and also all CrySiS variants[3], they enjoin victims to buy Bitcoins via sites like LocalBitcoin or CoinCafe and transfer them to a provided Bitcoin wallet address. Later on, criminals order victims to send them another email containing transaction details. The number of transaction is supposed to be a proof of ransom-payment, and then criminals are supposed to provide the Joker_lucker@aol.com virus decryptor. However, the situation can go the wrong way, and you can lose your money just like you lost your files[4]. It doesn’t matter what these scammers promise you – you cannot do anything against them, and so if they decide to ignore you, it means you will never get your files back. Paying the ransom is so not worth the risk, so we do not recommend doing it. Besides, keep in mind that you can restore files using data backup, so just remove Joker_lucker@aol.com virus using anti-malware tools like FortectIntego and plug in the backup[5] drive into the computer then.
How did this CrySiS variant plague your system?
Crysis ransomware is mainly distributed via malicious spam campaigns. You should beware of email letters coming from unknown people, and never open their attachments or basically any links included in the message. Sometimes it is hard to recognize such phishing messages because they are professionally designed to look convincing. Frauds tend to pretend that they are writing from well-known companies like Amazon, eBay, PayPal, or some healthcare organization. These scammers even pretend to be delivering medical test results, stating that the victim has been diagnosed with cancer. Of course, criminals can get shocked and rush to open fake medical reports added to such letters. You know what happens next – email attachment is not real document because it is a malicious file that contains ransomware. Opening such file leads to disastrous consequences, so do not rely on unknown senders and do not explore links and email attachments they send to you!
Delete Joker_lucker@aol.com.wallet file extension virus
If your files have been locked with this malicious virus, there is nothing much you can do. Files can be fully restored from a backup, and if you do not have it, we have to disappoint you by saying that it is impossible to restore them in any other way. Therefore, you should remove Joker_lucker@aol.com.wallet virus ASAP and take preventive measures to make sure that you never end up in such unenviable situation in the future. These Joker_lucker@aol.com.wallet removal guidelines will guide you through the malware removal process.
Was this guide helpful?
4 comments