How to remove Pashka ransomware

Pashka ransomware – a computer infection that uses AES encryption algorithm to lock all personal files on the system

Pashka ransomware is a file locking malware that was first spotted in early January 2020 by security researcher Amigo-A.^[1] While no samples have yet been uploaded, the virus already attacked several users and encrypted all pictures, MS Office documents, PDFs, videos, and other files located on the system utilizing the AES^[2] encryption method. As a result, victims are unable to access their data and are left in a difficult situation where, without backups, they need to pay a ransom to cybercriminals to obtain Pashka ransomware decryptor.

Besides encrypting all files on the host machine and appending .pashka extension, the virus also drops a ransom note named HELP_ME_RECOVER_MY_FILES.txt, which explains to users what happened to their files and how to recover them. Victims are asked to pay 0.03 BTC into a provided wallet and then contact hackers via unlockransomware@protonmail.com. However, doing so is not recommend, as threat actors might never send the required software to decrypt files, consequently leaving victims with nothing. Instead, users should focus on Pashka ransomware removal and alternative methods for data retrieval, which we provide below.

While there are more ransomware strains discovered recently that target businesses and public entities for larger ransom sums, it seems like Pashka ransomware developers went for regular users, which means that targets are most likely chosen randomly. For that, malicious actors behind the threat can choose a variety of methods to infect victims, including:

• Exploits and software vulnerabilities^[3]
• Spam email attachments and hyperlinks
• Backdoors
• Malicious websites
• Software cracks, etc.

Once the infection is triggered, Pashka virus places an executable file (a random name for that is typically used) into the % TEMP% folder and also extracts several other files into Users and Desktop folders. During this process, the Windows registry is altered, Shadow Volume Copies deleted, Startup recovery disabled, and all the other necessary preparations for file encryption process are executed.

The encryption process typically lasts just a few seconds, up to a few minutes depending on various factors, such as system configuration, HDD size, cipher key length, etc. After that, each of the files is appended with .pashka extension, so an example of a locked file would look as follows – picture.jpg.pashka, which would also not have a typical icon used by .jpg format, and simply appear blank.

Pashka ransomware then drops the following text file on the desktop and other locations, which  reads:

Atention! all your important files were encrypted!
to get your files back send 0.03 Bitcoins and contact us with proof of payment and your Unique Identifier Key.
We will send you a decryption tool with your personal decryption password.

Where can you buy Bitcoins:

https://www.coinbase.com
https://localbitcoins.com

Contact: unlockransomware@protonmail.com.

Bitcoin wallet to make the transfer to is:
3LtZ1DRUTupWFdxkgyTyMDa2AYEcNio4Pu3LtZ1DRUTupWFdxkgyTyMDa2AYEcNio4Pu
Unique Identifier Key (must be sent to us together with proof of payment):

It is true that a unique key is required to decrypt Pashka ransomware encrypted files, but it is also true that hackers are not the people you could put your trust in – they can simply take your money and vanish, proceeding to infect other victims in the meantime. Nevertheless, some users might find contacting crooks as the only way to recover their important data. If that is the case, you have been warned.

If you decide not to pay criminals, but you have no backups available, you should make a copy of the encrypted files before you remove Pashka ransomware from your machine with anti-malware software, as data may become permanently corrupted in the process. After that, you can try using alternative methods to recover your files. Note that ransomware may also damage or corrupt system files, which would result in its instability and crashes. Instead of reinstalling Windows, you can employ PC repair software FortectIntego, which can fix all the virus damage in one scan.

Use security precautions when dealing with online content 

Unlike other malware, ransomware is only stealthy before the infection stage. Once the malicious executable is launched, there is not much that can be done to protect files on the system, although shutting down the machine immediately might prevent the encryption of some data. Another trait of ransomware is that it does not revert the encrypted files back to normal, even after its removal – that is precisely what makes this type of infection especially dangerous.

While infected users might find it insignificant how they got infected with ransomware, this information can save them from repeating the mistake in the future. As a general rule, attack vectors include some type of social engineering, although the infection routine is mostly initiated by users who are simply unaware of security precautions or are simply ignorant. Therefore, it is important to ensure that comprehensive security precautions would be practiced in order to avoid the devastating consequences of ransomware infection.

Here are a few tips from security experts:^[4]

• Always apply all the software updates to Windows and other programs installed on your PC immediately;
• Employ next-gen security software that uses machine learning and other advanced malware detection methods;
• Enable Firewall to prevent network intrusions;
• Never open spam email attachments that ask to enable the macro function or click on hyperlinks;
• Use strong passwords for all your accounts by using alphanumeric characters or use a password manager;
• Do not download pirated software installers and cracks/keygens/loaders;
• Configure your Remote Desktop connection: never leave it open (default TCP port), protect it with a secure password, and turn it off when it is not needed;
• Backup all your files on a regular basis to negate the effects of ransomware.

Backup the encrypted files, delete Pashka ransomware and only then proceed with data recovery process

As previously mentioned, you should not remove Pashka ransomware straight away. Some file locking malware strains are programmed to exit the system as soon as the initial encryption process is finished, while others remain on the system and keep encrypting the incoming data. Some ransomware was also found to insert additional components that steal personal data (for example, some Djvu virus variants), or come with other malware, such as Trojans. The only way you can check for all this is by scanning your machine with powerful anti-malware software – you can use tools like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes and perform a full system scan in Safe Mode with Networking.

However, if you are not planning on paying criminals and do not have backups of Pashka virus encrypted files, you should ensure you make a copy first, as ransomware research teams are constantly working on deciphering new malware and providing decryption tools for victims. As for now, you could also try using third-party recovery software that might be able to recover at least some portion of your files – check the instructions below.