How to remove RandomLocker ransomware

RandomLocker ransomware that demands to pay 10 USD in 24 hours

RandomLocker is yet another ransomware virus that has emerged at the end of April 2018. It functions as a file-encrypting virus, which adds .rand file extension to locked files and replaces desktop's wallpaper with an “Ooops, your files have been encrypted!” screen. The new background image informs about encrypted data and demands the victim to contact randomlocker@tuta.io email address. The ransom RandomLocker is not high – 10 USD that have to be paid within 24 hours in Bitcoins.

The RandomLocker ransomware uses AES encryption algorithm^[1] and demands payment in Bitcoins. Since the ransom required is equal to 10 USD concerted to Bitcoins, the virus may be claimed to be the lowest ransom demanding crypto-extortionist.

The smaller the ransom, the bigger the possibility is to make hundreds or thousands of people of paying it. That's a trick people should not fall for. It's very likely that the RandomLocker virus may be under the development phase or test its capabilities. Therefore, the more ransom it collects, the more attacks it may further initiate. Besides, the price or redemption is not very likely to decrease.

According to ransomware researchers, this malware is being distributed manually, i.e., no bots applied to spread it via malspam or other social engineering techniques, at least yet. However, the ransomware is very likely to be under the development, that's why it may switch manual distribution to Exploit Kits, rogue software updates, spam, and other techniques upon finishing the development.

As soon as the RandomLocker malware gets inside, it unravels the payload called ransomware.exe. The latter starts running in the background and scanning for the targeted files. Each of them is then encrypted using AES 256 cipher and feature .rand file extension.

The new background image informs the victim about encrypted data and provides the contact email address, which is randomlocker@tuta.io. The full RandomLocker background image says:

Ooops, your files have been encrypted!

Encryption was produced using the unique key generated by this computer.
To decrypt files, you need to obtain the private key.
The single copy of the private key, with will allow you to decrypt the files, is located on a secret server on the internet;

The server will destroy the key within 24 hours after encryption completed.
Payment has to be made within 24 hours
To retrieve the private key, you need to pay 10$ in BTC

Bitcoins have to be sent to this address: 3GPg3tgwZakR5uTELzjMJRj1NarxHH9YdJ
After you've sent the payment, send us an email to randomlocker@tuta.io with subject: UNLOCK ***
If you are not familiar with bitcoin you can buy it from here:
SITE: www localbitcoin.com
After we confirm the payment, we will send the private key so you can decrypt your system.
—
FILES DELETED IN
01:58:24
About Bitcoin
How to buy bitcoins?
Show Encrypted Files
Contact Us
[***] [Decrypt]

This crypto-ransomware demands a redemption in Bitcoins,^[2] based on the current Bitcoin price, the victim should pay 0.0011 BTC (10 USD). Despite the fact that probably each computer user has such a sum of money in the wallet all the time, do not rush to give it away. Instead, we recommend you to remove RandomLocker virus with FortectIntego or SpyHunterCombo Cleaner.
There's no guarantee that criminals won't leave you without a decryptor after paying the ransom. Even worse, they can send you an infected decryptor, which may turn out to be spyware or worm. Therefore, take care of the RandomLocker removal asap.

At the moment of writing, only 19 AV engines out of 67^[3] can detect and remove RandomLocker malware. Therefore, make sure to select a reliable security tool and run scan only after the update.

Ransomware developers prefer hacking unprotected RDPs

Ransomware distribution techniques are more or less clear. However, the trends a slightly shifting. While earlier crooks relied on spam and rogue software in particular, currently the's more and more instances registered when hackers exploit unprotected RDP (Remote Desktop Programs) that are connected directly to the Internet instead of using VPN.

Once the security flaw is found, the RDP password is modified allowing the attacker to inject ransomware into the targeted machine. Therefore, if you are using RDP, make sure to protect it using a reliable VPN service.

However, malicious spam email attachments are still being considered as the most frequently used virus distribution technique. To protect yourself from malicious attachments, bypass each suspicious email, which does not have the subject, the sender is unknown, though the attachment is named as “Urgent.”

Eliminate RandomLocker ransomware virus with one click

RandomLocker removal is a complicated process that can only be performed by a professional anti-virus, such as FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Dievire.de^[4] team stresses the fact that only security tool can delete programs and files that are related to the malware or compromised by it.

Once you remove RandomLocker, you can download a third-party data recovery tool and run a full system scan with it. If it cannot recover some files, you'll be able to exploit Volume Shadow Copies or use previous versions.