Inchin ransomware – a cyber threat that comes from the Scarab ransomware family
Inchin ransomware is a notorious infection that comes from the Scarab family and appends the .inchin extension to each locked file and document. Discovered by Amigo-A and announced on Twitter,[1] this ransomware virus drops the RECOVER.txt ransom message where it provides Inchinaiturtle@protonmail.com and WuTang444@protonmail.com email addresses for creating communication between the cybercriminals and victims. The crooks offer to help the users to decrypt their files by delivering them the decryption software for a specific payment. Also, Inchin virus developers offer to send them one file up to 5 MB for a free decryption process as bringing up evidence that the recovery tool truly exists. Additionally, this ransomware virus has multiple similarities with Danger ransomware.
| Name | Inchin ransomware |
|---|---|
| Type | Ransomware virus/malware |
| Founder | Amigo-A is a cybersecurity researcher that has announced about his findings on Twitter social network |
| Appendix | The ransomware virus uses symmetric or asymmetric encryption to lock up the files and adds the .inchin appendix to each filename |
| Ransom note | This malware provides all of its threatenings and demands via the RECOVER.txt text message |
| Crooks' emails | The criminals add Inchinaiturtle@protonmail.com and WuTang444@protonmail.com email addresses as a way to contact them |
| Distribution | Ransomware infections are most commonly distributed through phishing emails and their infectious attachments. These cyber threats can also spread through cracked software that is downloaded from p2p networks, and through vulnerable Remote Desktop Protocol configuration |
| Removal | You can get rid of the ransomware virus by employing automatical software and carrying out the process with a strong and reliable antimalware tool. Keep in mind that the manual elimination is not an option in this case as you might miss some crucial steps or locations where the malware might be hiding |
| Data recovery | If you have discovered .inchin files and documents on your Windows computer system, you should not rush to pay the cybercriminals as these people might seek to scam you. Instead of taking such risk, go to the end of this article and try some data recovery methods that are placed there |
| Fix tip | If you have found some compromised entries or other areas on your affected device, you can try repairing them with automatical software such as FortectIntego |
Inchin ransomware is a notorious malware strain that can apply suspicious modifications to the Windows Task Manager and Registry locations. There you might discover unknown processes and registry keys injected. Note that such processes might allow the ransomware to boot itself up within every Windows computer startup process.
Continuously, Inchin ransomware might be able to scan the entire system once in a while and search for encryptable components. Once all files are locked, the cybercriminals save both encryption and decryption software on remote servers where the keys become unreachable for anyone except the cybercrooks themselves.
Afterward, Inchin ransomware provides a ransom message and threatens the users that the only way to recover the lost data is by purchasing the key from them, otherwise, the files might be lost forever:
All your files are encrypted, and currently unavailable. You can check it: all files on your computer have extension .inchin. Everything is possible to recover (decrypt), but you need to follow our instructions. Otherwise, you can never return your data. Write to our email Inchinaiturtle@protonmail.com.
It’s just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities – nobody will cooperate with us. It is not our interests.
For proof – send any file up to 5 megabytes and we will decrypt it.
If you will not cooperate with our service – for us, it does not matter. But you will lose your time and data, because we have the private key. In practice – time is much valuable than money.
However, we recommend not falling for believing in Inchin ransomware developers as these people might easily scam you. They might ask you for an inadequate sum of money and leave you with no tool at all. Mostly, such crooks demand Bitcoin or another type of cryptocurrency that allows the process to remain safe and untrackable.
Continuously, Inchin ransomware might try to harden the process for you by deleting or permanently damaging the Shadow Volume Copies of infected files by running specific PowerShell commands. Also, the malware might be capable of destroying the Windows hosts file to prevent you from accessing security-related websites and forum pages.
In addition, Inchin ransomware makes the infected Windows computer system vulnerable to other infections. As a result, you might end up with a Trojan virus on your machine. If this happens, it may result in serious data and money theft. Also, your machine might receive serious damage that can be hardly repairable.
You should remove Inchin ransomware from your Windows computer, otherwise, it might experience serious damage. Besides, you will not be able to recover your files properly until the infection is gone. If you are having trouble with detecting the malware, travel to the end of the article where you will find system rebooting steps.
After Inchin ransomware removal, you should scan your entire computer system for possible damage. If the software finds any signs of corruption, you can try fixing the touched areas with the help of a repair program such as FortectIntego. When the virus is gone and the damage is fixed, continue with data recovery techniques that are added to the end of this page.
Malicious actors deliver the infectious payload attached to phishing emails
Security experts from LosVirus.es[2] state that ransomware infections are widely distributed through email spam[3] and the malicious attachments that come clipped to the phishing email message. This happens when the crooks succeed to trick the victims by pretending to be from well-known shipping companies such as FedEx and DHL or from other healthcare and banking organizations.
You should always carefully verify the sender and his email address. If you are seeing a questionable email sender address, you should avoid opening the message. However, if you have already viewed the content of the message, do not click on any hyperlinks that are provided in it and check for possible grammar mistakes as if it were a note from a reliable organization, no mistakes would be left in the text.
Continuously, cracked software is another possible delivery source of ransomware. If you are a frequent visitor of peer-to-peer networks, you might find yourself sitting with malware afterward. A piece of advice would be to get all of your products and services only from reliable websites and the official developers. Also, use antimalware protection so that you would be alerted if something dubious or malicious is trying to sneak into your computer system.
Last but not least, ransomware infections are distributed through unsecured Remote Desktop Protocol configuration. If the RDP includes an easy-guessable password such as “abc123”, then the hackers might easily hack your machine. Having none password at all, doubles the risk. What you have to do is properly secure your RDP. Think of complex security codes that include symbols, letters, and numbers.
Automatical removal guidelines for Inchin ransomware
If Inchin ransomware has been launching malicious processes that have been preventing you from detecting or eliminating the malware, you should boot your computer in Safe Mode with Networking or via System Restore to deactivate the ransomware virus first. We have provided instructions for both booting methods at the end of this article.
Afterward, you should proceed with Inchin ransomware removal automatically. This includes downloading and installing antimalware software that is strong enough to detect and remove the ransomware virus from your Windows computer. Also, if you want to look for possible damage, you can try employing software such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes.
If the tools discover any corrupted areas, you can try fixing them with a tool such as FortectIntego. Once you remove Inchin ransomware from the computer and fix all the damage that it might have brought, you can start going through some data recovery tips that have been added to the end of this page and might help you to restore some of your files.
Did this guide help?
Be the first to comment