Exocrypt is a malicious program that belongs to ransomware category
Exocrypt ransomware is a malicious program that claims to be created for educational purposes. Recently, security experts reported about its second version called as Exocrypt XTC v2.0.[1] Each of these crypto-viruses[2] are set to lock personal victim's files and block the access to them until he or she pays the ransom. Ransomware is still using AES encryption algorithm to create a hardcoded password for archived data on the victimized PC.
| Name | Exocrypt ransomware |
|---|---|
| Alternative name | XTC ransomware |
| Versions | Exocrypt XTC v2.0 |
| Type of malware | Ransomware |
| Main file | Exocrypt.exe |
| Distribution | Spam email attachments, fake software updates |
| Danger level | High. Locks data and asks for redemption |
| Encryption used | AES |
| Related files | Exocrypt.exe |
| To eliminate this ransomware, download FortectIntego and run a scan with it. | |
Following the encryption, the virus scans the system for compatible file types and renders AES-256 cryptography[3] to make them inaccessible. It’s not clear yet what file extension it uses, but experts consider it to be .xtc. In most of the cases, the Exocrypt ransomware infiltrates on PCs via malicious email attachments or fake software updates. It seems current that extortionists do not take advantage of exploit kits and unprotected Remote Desktop services.
As soon as all the detected data is encrypted by Exocrypt XTC v2.0, user receives a .html ransom note which, once opened, demands $50 that should be paid in Bitcoins within 24 hours. While the ransom is believed to be one of the smallest ones, the time given for exchanging currencies and performing a transaction is quite limited.
The ransom note of the first version reads:
All your personal files have been encrypted, your photos, videos and documents are no longer accessible, don't cry yet because I have not deleted them… Yet…
In order for me to decrypt your files for you, you must pay a small fee to the following bitcoin address, payment will only be accepted in bitcoin to insure anonymity… Try anything funny, and your files will be permanently encrypted forever.
Good luck.
24:00:00
$50 in BTC *** [Decrypt]
The second version notes its victims:
This ransomware was made for educational purposes, we will not send out any copies of this virus, unless it is for forensic purposes!
No matter what is reported, you should realize that you are dealing with a serious virus. It’s not advisable to pay the ransom anyway. Even if you have some Bitcoin coins in your digital wallet, do not rush to give them away for criminals. No one can assure you that you’ll get your files back after the payment. Instead of that, scan your PC with FortectIntego, SpyHunterCombo Cleaner, MalwarebytesMalwarebytes or another professional anti-malware and remove Exocrypt ransomware permanently.
By the way, do not fall into a panic if Exocrypt removal is not permitted. Ransomware-type viruses use scripts to disable security programs to evade removal. To bypass the restriction, you should restart your PC into Safe Mode with Networking and then try to run a scan.
Most common ways how ransomware enters the system
As we have already pointed out, this ransomware virus spreads either inside spam email as an attachment or as obfuscated software updates. Both ways criminals render social engineering strategies to convince potential victims that the attachment or installer is reliable.
They impersonate legitimate companies, such as Amazon, eBay, etc. or camouflage legitimate products that belong to Microsoft, Adobe, and similar. The usunwirusa.pl[4] team of security researchers points out the following precautionary measures that you should take to protect the system from ransomware attack:
- Always use professional security software and make sure it’s up-to-date;
- Exploit the Real-time protection feature of the security program;
- Do not open email messages from unknown senders or companies you do not recognize having business with;
- Be careful with peer-to-peer (P2P) networks as instead of a video, audio file or software you can end up with the virus.
- Finally, restrain from clicking on questionable ads, even if they promote popular products for a small prize.
Home users should rely on professional anti-virus to remove Exocrypt ransomware
IT specialists that are oriented to cybersecurity and viruses are well-equipped and skilled in running various scripts to remove Exocrypt and similar ransomware. If you are not that tech-savvy, we would not recommend trying to eliminate this pest manually as you may not only lose personal files permanently but also damage your PC.
Upon Exocrypt removal, use your backups to unlock files encrypted by XTC virus or render third-party software recovery tools. But before that, double check if the virus has been removed by running a repeatable system’s scan with an anti-malware. Otherwise, your files will be encrypted again.
Was this guide helpful?
Be the first to comment