How to remove Everbe 2.0 ransomware

Everbe 2.0 ransomware is a file locker which comes back with undecryptable variants

Everbe 2.0 ransomware is a crypto virus, and its primary goal is to lock up data and demand ransom for its the decryption key. The cyber threat is a successor of Everbe ransomware, which was first potted in March 2018, and showed up again several times as Embrace, Embrace, EvilLocker and Hyena Locker. The virus uses AES ^[1]  and RSA encryption algorithms to encrypt data. While initial version used .everbe appendix, the latest variant which was discovered in September 2018 uses .NOT_OPEN file extension, !. txt _HOW_RECOVERY_FILES ransom note and urges users to contact hackers via the notopen@cock.li or tryopen@cock.li emails. Unlike some previous variants, the latest ones are sadly not decryptable yet.

When analyzing the sample it appeared that various antivirus programs detect this threat. This fact indicates that the best solution for Everbe 2.0 elimination is anti-malware tools or your trustworthy antivirus. It is possible that ransomware disturbs your antivirus, so you may need to enter the Safe Mode before scanning the system. You can see this method more in dept on the guide below the article. 

The latest version of Everbe 2.0 ransomware displays the ransom note which reads the following:

>>>>>>>>>>>>>>>>>>>>>>>>>>>> NOT_OPEN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<

HELLO, DEAR FRIEND!

1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the decryption program.

2. [ HOW TO RECOVERY FILES? ]
To receive the decryption program write to email: notopen@cock.li
And in subject write your ID: ID-[redacted 10 hex]
We send you full instruction how to decrypt all your files.
If we do not respond within 24 hours, write to the email: tryopen@cock.li

3. [ FREE DECRYPTION! ]
Free decryption as guarantee.
We guarantee the receipt of the decryption program after payment.
To believe, you can give us up to 3 files that we decrypt for free.
Files should not be important to you! (databases, backups, large excel sheets, etc.)

>>>>>>>>>>>>>>>>>>>>>>>>>>>> NOT_OPEN LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<

This NOT OPEN LOCKER virus that belongs to Everbe ransomware can be detected by AV^[2]. These results might show up after the scan:

• Generic.Ransom.Everbe.3D90239A;
• Win32:Malware-gen;
• HEUR/AGEN.1031998;
• Trojan.Win32.Generic!BT;
• W32/Trojan.YOEK-2696;
• W32/Filecoder.NQU!tr.

One of the newest variants of Everbe 2.0 ransomware showed up mid-July and is dubbed Hyena Locker ransomware. It encrypts files with a strong cipher and adds [hyena@rape.lol].HYENA file extension. Victims are asked to contact hackers using hyena@rape.lol or hyena@cock.lu email addresses, which is presented in a ransom note !_HOW_RECOVERY_FILES_!.txt:

>>>>>>>>>>>>>>>>>>>>>>>>>>>> HYENA LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<

HELLO, DEAR FRIEND!

1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the decryption program.

2. [ HOW TO RECOVERY FILES? ]
To receive the decryption program write on our e-mail: hyena@rape.lol or hyena@cock.lu
And in subject write your ID: ID-[redacted 6 hex]
We send you full instruction how to decrypt all your files.

3.[ FREE DECRYPTION! ]
Free decryption as guarantee.
We guarantee the receipt of the decryption program after payment.
To believe, you can give us up to 3 files that we decrypt for free.
Files should not be important to you! (databases, backups, large excel sheets, etc.) 

>>>>>>>>>>>>>>>>>>>>>>>>>>>> HYENA LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<

 As evident, Everbe 2.0 ransomware evolves, and it is more and more dangerous with each version – still not decryptable by security experts. Thus, users should not take this attack lightly. Nevertheless, no matter how desperate some users can be to get their files back, researchers^[3] do not recommend contact cybercriminals, as it can lead to money loss.

You better remove Everbe 2.0 virus using anti-malware tool like FortectIntego and clean your system immediately after noticing any locked files on your system. Encrypted data is important to recover, but you need to be aware that plugging any USB or another external drive to a compromised system can result in permanent data loss. Ransomware will lock any incoming files, regardless if they are downloaded from the internet or a back-up. 

Although this variant is not decryptable, you will find instructions below on how to use third-party tools that might help you to possibly recover data. Additionally, if malware is blocking the operation of security software, the guide below will help you with Everbe 2.0 ransomware removal when using Safe Mode with Networking. The cyber threat can disable anti-virus programs, so anti-malware tools and preferably two different ones can ensure that all possible infections are detected in time. 

Some piece of advice would be to keep copies of important data safe on external devices such as USB drives, iCloud, or other. Various sneaky viruses like Everbe 2.0 ransomware will not be able to access safely-stored files, and they will remain safe even though the cyber threat encrypts those documents which are on your PC.

Virus activation source can be hidden inside of a spam email

If you receive an email that you are not expecting and it is from a company you do not know or service you do not use, be aware that this might contain virus-filled attachment or link with virus activation source. Delete these ambiguous letters immediately without opening. 

Spam email^[4] box fills up with questionable content automatically. And, while there is a possibility that a legitimate email might have sneaked in there, you should still take great care when opening messages from your Spam box. If you open any email casually and click on links or attachments – you are in at an increased risk of malware infection.

As soon as the contaminated file is opened, ransomware executes its malicious code on your PC. Thus, take several precautionary measures to avoid infection:

• Do not open every spam email (and especially attachments) casually – make sure it is legitimate first;
• Employ robust anti-malware software and keep it up to date;
• Download programs and updates from legitimate sources only;
• Patch your software as soon as new updates are out;
• Avoid using file-sharing or cracked software websites.

Eliminate Everbe 2.0 ransomware and do it now

To remove Everbe 2.0 ransomware or any other ransomware, you need to employ legitimate tool. FortectIntego and MalwarebytesMalwarebytes can be used for that purpose. These programs scan the computer system thoroughly and, if any threats are detected, eliminate them promptly. After that, you can proceed with normal computer operation.

If Everbe 2.0 ransomware removal goes as planned, you can try to decrypt and recover your files. Use backups or below mentioned methods to restore encrypted data. Keep your anti-virus programs up to date, since ransomware uses system vulnerabilities to its advantage. Make sure your anti-virus is set to scan your machine automatically from time to time.