How to remove Bin ransomware

Bin ransomware is a new virus that originates from Scarab ransomware creators 

Bin ransomware — a virus that uses sophisticated AES encryption^[1] to lock up users' data and is also one of the most dangerous cyber infections around. Malware appends the .[mrbin775@gmx.de].bin file extension to each of the affected personal files and renders them unusable. It can encrypt any type of data, like photos, videos, documents, archives, etc. Immediately after successful encryption, ransom note HOW TO RECOVER ENCRYPTED FILES.TXT is downloaded and injected into folders where compromised files are located. Hackers ask victims to contact them via mrbin775@gmx.de or mrbin775@protonmail.com and demand to pay ransom for data release which is paid in cryptocurrency – usually Bitcoin. The virus is the continuation of the infamous Scarab ransomware family; thus, cybersecurity experts dubbed this version Scarab-Bin ransomware.

Ransom message reads the following:

Your files are now encrypted!
Your personal identifier:
[random characters]
For instructions for decrypting files, please write here:
mrbin775@gmx.de
mrbin775@protonmail.com
If you have not received an answer, write to me again!!

The amount of ransom is not specified by hackers, although previous versions of Scarab demanded 0.18 BTC.^[2]Thus, we can only guess what Bin ransomware authors will request this time. Nevertheless, it is probably dependent on how fast the victim contacts them. As usual, we do not recommend doing that, as facing money loss is a highly likely scenario. 

What is more, if you decide to pay to redeem files, it will prompt hackers to create more malware and infect more computers, a business model becomes a success. Besides, you can become a victim of repeated attacks, knowing that you are willing to pay. While data encryption is unfortunate, you should focus on Bin ransomware removal first.

Another reason to remove Bin ransomware is that the virus makes significant changes to the system, including Windows Registry modification, Shadow Volume Copy deletion, and others. This can render your device vulnerable to other malware attacks, such as trojan horses, crypromining malware, spyware, etc. Therefore, do not delay and scan your computer with FortectIntego – a reputable security program that is capable of detecting and destroying cyber threats.

Phishing email campaigns can be used to spread ransomware

Researchers^[3] note that phishing email can be used to disseminate fake messages that look safe, because of the legitimately-looking “From” address, which is actually an imitation of well-known company or organization. Ransomware can be infiltrated via the direct file attachment or a hyperlink in the letter. 

Often these email attachments look safe because of the familiar MS Word or Excel format. However, these documents can be infected so, as soon as you download and open them, your computer gets infected with malware. You can avoid this if you stop casually opening emails from unknown sources.

If you delete them from spam box without opening, you can be sure that there is no threat. Also, big company names can be used in these campaigns, and legitimate logos, styling, and names can be deceptively used.

Get rid of Bin ransomware and other related pieces

To remove Bin ransomware, you should use anti-malware tool like FortectIntego or MalwarebytesMalwarebytes, because manual elimination of a sophisticated malware is almost impossible. Using security software is also a good idea because the virus could have let additional threats into your system.

Bin ransomware removal is crucial if you want to decrypt your files because any files on a remote server or an external drive can repeatedly be encrypted. Double check if your system is clear before you try any decryption method. If you do not have a backup ready, you can use our guide for third-party software that may help you with data recovery. Remember to take the security of your system seriously and keep your anti-virus up-to-date.