Adame ransomware (Bonus: Decryption Steps) - updated Sep 2019

What is Adame ransomware?

Adame ransomware is the cryptovirus, supposedly spreading with Adobe software cracks and torrent files

Adame ransomware is the virus that makes a huge difference in the speed and performance of the infected device due to additional background processes. Adame cryptovirus is the ransomware that gets on the system as a installations file of Adobe cracks, video game cheats. This is a vector used by other virus developers because people tend to pirate various programs and serial numbers or license keys of tools. Users^[1] recently reported about the renewed virus activity and many of these online forum posts state that people downloaded Abode Lightroom, Adobe Photoshop, Adobe Premiere, Adobe After Effects, Adobe Animate, and other software from this provider. Apparently, one of the installer files contain malware instead of needed information and raises questions when the needed program is not openable. However, the question is answered when ransom note in the form of a pop-up program window named info appears on the screen. The note also can be loaded on the desktop as info.txt file.

People state that files immediately get unreachable and marked with .Adame extension, hence the name of the virus, so the ransom demand can be made. Remember this and the fact that Adame ransomware virus is a version of Phobos ransomware. This relation indicates the possibility that malicious ransomware payload includes modules that affect the system and can further infect the machine with trojans, worms, other malware.

Also, it is known that the family of Phobos loads processes and executables on the machine to ensure the persistence and interfere with the performance of infected computer further. “The App that Reminds You to Move More” is the process that can be found running in the background. As typical for the family, the ransom note initially delivers instructions and when the victim follows provided links the amount appears on the payment system. However, this is never the recommended route.

Virus developers claim that they can recover affected files with the only possible solution – decryption key they develop for each victim separately and allegedly shares it with a victim after the money transfer. Unfortunately, ransom paying is not the best solution since contacting cybercriminals can lead to more issues with the machine or even further damage to the device.^[2] Ransomware is based on blackmailing victims, so virus developers have no mercy for you or your files.

Adame ransomware is the virus that completely overwhelms the victim with all the changes in the system and the ransom demand. However, ransomware has more features than file encryption alone. Since it aims to make a profit from infecting machines, it can also steal valuable information and email addresses or credentials that can be used in secondary scamming campaigns.

It is known that like any other cryptovirus, Adame ransomware targets online banking credentials, personal logins or passwords and other details stored directly on the device or saved on the browser as auto-fill information. In addition to this background process, the virus can:

• alter Windows configuration files;
• add new registry entries;
• delete files;
• add programs or data;
• infect the machine with other malware.

Adame ransomware is the malware that shows up with a ransom demanding message and makes people eager to pay. However, all the malicious processes happen in the background.

Adame ransomware starts the attack with infecting the machine and checking the location of the device. Sometimes particular countries are excluded from such processes. If the system is suitable for the infection, the ransomware runs AES encryption algorithm and encodes all the data found on the machine. Common files like photos, documents, videos, music, audio files get encrypted and then encrypted.hta appears on the screen with the following message:

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail supportcrypt2019@cock.li
Write this ID in the title of your message:
In case of no answer in 24 hours write us to this e-mail:supportcrypt2019@protonmail.com
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Besides this program window with direct payment transfer instructions, a virus can add info.txt text file on the screen that contains less detailed information. In most cases, Adame ransomware repeats contact information and lists emails in the text file where criminals encourage people to follow instructions in the HTA file as soon as possible.

Adame cryptovirus changes tactics over time

.Adame virus tactics differ from attack to attack, but all reports and user-provided samples revealed more unique information about the threat. Some user posts online showed that ransomware included different coding than before or than any other virus in this category before. Instead of focusing on file encryption in formats like photos, documents, and so on, malware encodes system data and valuable files like Windows Configuration files, driver files, data needed for restoring.

Such data disruption on the system seems to be more effective before targeting common files stored on the machine because disabled security software, crucial system functions allow virus developers to access and encrypt files much easier. This way, the virus cannot be detected too.

Adame ransomware from the beginning was known for being persistent and spreading in large-scale campaigns. Developers want to infect as many devices as possible in one attack. This is probably the most spread and currently active versions in Phobos ransomware family.

The month of September 2019 came with mote reports and virus samples from users. This data revealed additional unique facts about spreading and Adame ransomware:

• people get this virus after installing Adobe products;
• malicious payload loaded as installer file or executable;
• files even come from trusted uploader torrent with loads of seeders.

Don't trust such public sites and torrent services, malware developers hit such websites and use various flaws to obtain money from many victims. Phobos ransomware cannot be decrypted at this point, so you need to focus on virus removal and possibly store encrypted data on the external device until the tool gets created.

Adame virus is the threat that changes its malicious tactics and can run different commands on the machine besides the file encryption.

Although criminals behind this threat claim about decryption possibility, you need to remove Adame ransomware without even considering the ransom payment. There is no need to spend your money when, in most cases, the decryption tool does not exist. Developers change the initial code, and this virus is distributed in various campaigns that target large scale of victims. Global attacks aim to affect as many people as possible. So this is one of the most popular and dangerous Phobos versions.

Reports about this threat also show that Adame ransomware removal becomes impossible after some time. The virus can propagate across various mediums and load other files, processes, programs on the machine. All those associated intruders, alterations on the system can ensure that malware is more persistent.

This is the reason why experts^[3] always recommend rebooting the machine in Safe Mode with Networking and then running a system scan with tools like FortectIntego. When you run a check on the machine, anti-malware tools can indicate Adame ransomware payload, malicious files, and virus damage, so you need one tool to eliminate the threat completely.

Common ransomware is being spread by hackers

When it comes to threats like ransomware, the more common distribution techniques are phishing attacks and infected files that get attached to spam emails. These campaigns that spread cryptovirus involves techniques that allow to deliver malware across multiple platforms and spread them to a bigger number of potential victims.^[4]

Cybercriminals and hackers are more likely to spread such a serious threat because they aim to scare people into paying the ransom. Also, this is more advanced and involves experience in coding such sophisticated malware. Many reports state that torrent files, even from verified accounts or trusted soruces deliver malware payload.

You shouldn't trust any person, service or website that provides such cracks, serial numbers of legitimate software, cheats of video games and license numbers of security programs are one of the more popular things that people try to pirate online. However, some of the installer files contain executables with ransomware payload and once you trigger the installation, you get your PC infected.

Developers always changing their tactics, so be aware of other methods like infected documents – the popular technique of delivering the malicious script. Macro-infected documents are loaded on legitimate-looking emails with subject lines like Invoice, Order information, Shipping details as attachments. Once the PDF or Word document gets downloaded and opened malicious macros trigger the drop of the ransomware payload. Ransomware infiltration happens in seconds and you cannot stop the process.

Adame ransomware removal is the process that requires more help from professional tools

You need to react to Adame ransomware virus infection as soon as possible because malware can propagate further and infect more devices on the same network or even permanently damage the machine. Hackers can target further than your own PC.

As soon as you notice the suspicious activity on the machine and get your data affected, you need to remove Adame ransomware completely. If you react quickly, you can eliminate all traces of the virus and take your system back to a safe place without malware.

Unfortunately, manual Adame ransomware removal is not giving the best results because of its reported persistency, you need to get automatic tools like anti-malware tools and run a full system scan. Using FortectIntego, SpyHunter 5Combo Cleaner, or Malwarebytes can give you the advantage because these programs terminate the malware itself and clean virus damage.