How to remove Lulz ransomware

Lulz ransomware is crypto-malware that belongs to Project Root RaaS scheme

Lulz ransomware is a new file locking malware strain that was first analyzed by security experts from SentinelOne.^[1] Once inside the system, it encrypts 195 file types located on the local and connected drives with the help of the AES-256 encryption algorithm and appends .lulz marker to each of them (for example, a picture.jpg is turned into picture.jpg.lulz). After that, the data becomes inaccessible, and victims are asked to pay a ransom in order to regain access to it – a brief message from hackers appears in the “F*ck.txt” file, as well as a desktop wallpaper which is altered from a preset one.

Lulz ransomware is one of the first releases based on Project Root – a Ransomware-as-a-service^[2] scheme. Crooks, even without much of a programming proficiency, can buy the malicious payload via the Dark Web and use it for a cut from the profits made by collecting ransom payments from victims.

Lulz ransomware, while not extraordinary, has multiple tricks up its sleeve. Similarly to LockerGoga, the malware is written in Golang, which allows the payload to avoid both machine-learning and signature-based detection techniques by anti-virus engines. Nevertheless, most of the security solutions are equipped with advanced engines and might be able to stop the infection before file encryption is performed. Thus, for Lulz ransomware removal and protection, use reliable protection measures.

Lulz virus is programmed to exit the machine upon detecting a sandbox environment,^[3] such as VMware and Oracle VirtualBox (these are usually used by security researchers to analyze malware samples). Before proceeding with the infection, it will also attempt to establish the connection to one of amazonaws.com addresses, to ensure that internet connection is available on the targeted machine. Lulz ransomware will then try to disable the installed anti-virus applications.

Once the preparations of Windows or Linux operating systems are done, Lulz ransomware will look for the following file types and encrypt them with a secure symmetric encryption AES-256:

001, 3fr, 7z,asset ,d3dbsp, ,mdbackup ,pkpass, ,psk ,rar accdb, ai, apk, arch00, avi, bar, bay, bc6 bc7 big, bik bin, bkf bkp blob bsa c, cab, cas, cdr, cer, cfr, con, cpp, cr2, crt, crw, css, csv, das DayZProfile, dazip, db0, dbf, dcr, der, desc, dmp, dng, doc, docm, docx, dwg, dxg, epk eps, erf, esm ff flv, forge fos, fpk fsh, gdb, gho,iso gif, hkdb hkx, hplg, htm, html, hvpl, ibank, icxs, indd, itdb, itl, itm itm, iwd, jpe, jpeg, jpg, js, kdc, kf, lbf, litemod, lng lrf ltx lvl m2, m3u, m4a, map, mcgame, mcmeta mdb, mdf, mef, menu, mlx, mp3, mp4, mpq, mpqge, mrwref, ncf, nrw, ntl, odb, odc, odm, odp, ods, odt, orf, p7b, p7c, p12, pak, pdd, pdf, pef, pem, pfx, png, ppt, pptm, pptx, psd, pst, ptx, py, qdf, qic, r3d, raf, raw, re4, rgss3a, rim rofl, rtf, rw2, rwl, sav sb, sc2save sid, sidd, sidn, sie, sis, slm snx, sql, sr2, srf, srw, sum, svg, t12,t13, tax, tor, torrent ttarch2 txt, unity3d upk, vdf, vfs0 vpk vpp_pc vtf, w3x, wb2, wma, wmo wmo, wmv, wotreplay, wpd, wps, x3f, xf, xlk, xls, xlsb, xlsm, xlsx, ztmp

The changed wallpaper will refer users to the ransom note Fu*k.txt which states the following:

You are hacked
your all files have been encrypted
if you want you files back
email us here : xxxxxx@protonmail.com with your unique id => xxxxxxxxxxxxxxxxxx
F*ck you!!!

Please do not contact cybercriminals behind the ransomware, as, looking at the way they communicate with victims, it is highly likely that they might not send back the Lulz ransomware decryptor, even after payment is transferred. Instead, you could attempt to recover data with the help of third-party recovery software such as Data Recovery Pro or Shadow Explorer. Under certain circumstances, alternative methods may help you retrieve the locked data, although the chances are very low.

However, before that, you should remove Lulz ransomware from your computer, which might prove to be a challenge for some, unfortunately. Due to the sophisticated functionality of malware, we highly recommend you access Safe Mode with Networking for the process. After you are sure that all Lulz virus components are eliminated, you could also use FortectIntego to recover from system errors caused by malware infection.

Ransomware authors can use multiple different distribution methods

The ransomware-as-a-service scheme allows multiple different threat actors to buy the service and customize it before deploying it to the victims. Therefore, even the same malware might have different features or be delivered in different methods, depending on its distributors' preferences. If you want to protect your machine from ransomware, you should be ready for everything – check out these security tips from industry researchers:^[4]

• Employ reputable anti-malware software that uses advanced detection methods and provides real-time protection;
• Enable Firewall and protect your WiFi connection with a secure password;
• When using Remote Desktop, change the default TCP port, use a strong password and always disconnect from the service once complete;
• Beware of spam email attachments that ask you to enable macros – these phishing emails might seem legitimate from the first sight;
• Never download pirated software installers or cracks/keygens – these tools are often infused with malware;
• Patch your system with the latest security patches;
• Set all the installed software to be updated automatically.

Finally, you should backup your files – this will save a great deal of frustration when dealing with ransomware infection.

Lulz ransomware elimination might get tricky – here's what to do

As we previously mentioned, the Lulz virus is capable of using evasion techniques and might also be able to disable your anti-virus software. Luckily, the Safe Mode environment usually tackles these problems and prevents ransomware from reaching its goals. Therefore, if you fail to remove Lulz ransomware normally, you should access the Safe Mode, as explained below. If your security software does not start or got corrupted by malware, you should download the installer from an unaffected computer, transfer it via the USB or DVD, install it, and only then run a full system scan.

Once you complete Lulz ransomware removal, you should first backup all your data. Paying criminals is one of the possibilities of recovering your files but be aware that:

• the provided tool might not work or be contaminated with other malware;
• crooks may simply ignore you after they get your money.

Therefore, rather attempt to recover your data with third-party solutions first. Likely these will not be effective for all files, although some parts may be recovered successfully. If no luck, you should wait for security experts to find vulnerabilities within ransomware code and release a working Lulz ransomware decryptor in the future.