How to remove Coronavirus ransomware

Coronavirus ransomware is the threat distributed through fake site promoting optimization software from WiseCleaner

Coronavirus ransomware is the cryptovirus that spreads a malware cocktail with ransomware and info-stealing trojan and uses the pandemic situation to mock people. Attackers build a campaign that uses a fake website impersonating the legitimate Windows system utility site wisecleaner.com.^[1] The downloads distributed WSHSetup.exe file that acts as a downloader of CoronaVirus ransomware and Kpot trojan which is set to steal data like passwords and logins. The file gets executed and various files get downloaded from a remote server that criminals are monitoring. The encryption-based malware targets files in common tyes like images, documents, video, audio files and other data like archives or databases. Once that is done, files get renamed and marked the same because data receives a new name that is attackers' email address. In some cases, samples showed that the email address got added to the name a few times.

Coronavirus ransomware virus also places a ransom note file on many folders with the affected files. CoronaVirus.txt contains instructions and money demand. Amount asked from victims can differ, but the known amount in this campaign is 0,008 in Bitcoin. The analysis of the provided Bitcoin wallet shows that victims haven't paid these attackers yet. The virus also renames the C: drive to CoronaVirus, even though it does nothing besides scaring victims and making fun of them. The threat also shows the same message when the machine is rebooted as a lock screen and you cannot get back to the system. It is possible that the ransomware part of the cocktail is used as a cover for the Kpot trojan, but further analysis is in the process.

Coronavirus ransomware is the self-named threat that enters the machine alongside other malware and affects files directly by encrypting them directly. In the meantime, trojan steals passwords, logins and other data needed for the attackers and criminal activities.^[2] 

Coronavirus ransomware is loaded on the machine from the promotional site that should distribute software from WiseCleaner. Attackers use the sensitive time when people fear and get anxious more and more about possible risks and dangers of the COVID-19 outbreak. This particular cryptovirus was discovered by researchers who started to analyze the source of the site and downloaded files deeper. 

Coronavirus ransomware may be a wiper and only there to hide the activity of info-stealer trojan. The attack starts with the impersonated site that downloads the WSHSetup.exe instead of the wanted or needed tool and downloads both malware payloads. Once the file gets executed it installs a handful of different files from a remote server. One of them is a direct ransomware installer and another – drops the trojan.

Coronavirus ransomware removal is especially needed because of the fact that additional malware gets dropped alongside it. Once the trojan gets launched it steals cookies, login credentials from your web browsers, messaging application, email accounts, gaming sites, and other services. Kpot is capable of taking screenshots of the desktop when it is active and can steal cryptocurrency wallet information or credentials for other payment platforms. 

Coronavirus cryptovirus affects files stored on the machine, but the infected computer can get corrupted by the attackers later on when the stolen information is used because all the details get stored in the remote server operated by the criminals. This one attack can lead to more targeted scams or blackmail campaigns, so try to remove the malware as soon as possible. Coronavirus ransomware starts the infection with a payload drop and immediately goes for common files that can be encrypted and affected by the threat. When this is done, typical ransomware adds the particular file marker – an extension that indicates data already encrypted and often contains the name of the infection. In this case, attackers change the initial filename completely to their email address. Some samples showed that files received the email address a few times, so victims know that the email(coronaVi2022@protonmail.ch) is a preferred option for communication. However, expersts^[3] don't recommend contacting them at all. 

Coronavirus ransomware states all the actions that the victim needs to take in the ransom note file CoronaVirus.txt that gets added in various folders with encrypted files and on the desktop. It includes the wallet address that should receive the payments from affected people, but at the time of writing there were no transfers sent tot he address in particular. The same message appears on the boot screen when you try to reboot the computer, unfortunately. 

Malware also mocks people and tries to scare them even more by changing the name of C: drive into the CoronaVirus. It changes nothing, so it is there to troll victims of the encrypting Coronavirus ransomware. It modifies registry keys, launched executables and adds different files that block or load service on boot and on the machine when needed. 

Coronavirus ransomware disrupts these reboot services, but eventually, it shows the text file again and runs in the background. There might be some vulnerabilities in coding or flaws that researchers may use in their favor, so analysis of samples are especially needed. However, based on a political message, low ransom amount and bitcoin address that is static, researchers think that this virus may be created to cover up the Kpot trojan informationžstelaing activities. 

Coronavirus ransomware termination should be launched as soon as possible, so all the background activities and processes may have not been triggered yet. The machine can get compromised from the processes, applications and files installed and launched without your permission. You need professional anti-malware tools for cryptovirus elimination, so choose official sources and don't fall for another fake site. To fix this additional virus damage and other payloads possibly loaded as the secondary stage, run FortectIntego or a different system tool, so files can get repaired completely. 

Attackers created the impersonating website to spread malware cocktail

The most common way to spread ransomware threats is malicious files. These files can be documents, executables, system files or program launchers and get distributed with the help of other threats, websites and email spam campaigns. This particular attack relies on the legitimate Windows system utility site wisecleaner.com that gets impersonated and delivers malware downloaders.

Tool downloads on the site are not working, they drop the malware instead and installs the WSHSetup.exe file that when triggered and executed installs a handful of additional malicious files. Some of them drop the direct ransomware payload and trojan infection. 

Installers attempt to steal data and make changes as soon as possible and the one that contains ransomware payload triggers file-encryption as soon as it lands on the computer network. Once the encryption is done, you will receive the note and notice all the symptoms.

Clean the machine fully by eliminating Coronavirus malware alongside other threats

Coronavirus ransomware virus, unfortunately, is the threat that spreads around with the trojan and possibly can run other processes in the background of your device, so you cannot recover files, detect malware and use the computer at all. Time, in this case, is especially important because the more time a virus has on your device the more damage it makes on there.

To avoid changes and serious damage to your crucial system parts, you need to remove Coronavirus ransomware as soon as possible. The best time is to treat the virus as soon as you get the ransom note displayed before you. As for the options of the cleaning processes, you should rely on the best method – AV engines and virus detection tools. 

Coronavirus ransomware removal gives the best results when you rely on professional and powerful anti-malware programs like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes and clean the machine from any possible intruders. Also, tools like FortectIntego can further help with files affected by the virus and damaged system functions or registry entries.