How to remove LeChiffre virus

LeChiffre ransomware – file-locking virus that is installed manually after an RDP break-in

LeChiffre ransomware is a relatively old data-locking malware from 2016. Back then, it was known for attacking three banks and a pharma company in Mumbai. Unlike many other viruses of this type, it is not distributed in the regular ways, such as malspam or exploits, but rather installed manually by the attackers. In other words, other ransomware use automatic procedures to reach out and later execute the malicious payload on the targeted machine, while the LeChiffre virus' executable needs to be launched by threat actors manually. Criminals are in search of vulnerable RDPs,^[1] crack them, and forcibly enter the login password from a remote server.

As soon as malware is launched, the encryption process with RSA-1024 and AES^[2] algorithms is performed, appending .LeChiffre extension in the process. Suchlike documents, pictures, videos, databases, and other files become inaccessible to the victims. In order to recover data, they are asked to email the attackers via the decrypt.my.files@gmail.com email and pay the ransom. Some victims claimed that they were asked for 1 Bitcoin in exchange for a unique key/decryption tool.^[3] Paying the ransom is not recommended, however, as there is a fully working, free decrypter available from security company Emsisoft.

Fun fact: LeChiffre is a French word and means “the number,” although the verb version of it also means “encrypting” or “encryption.” While it is easy to assume that the attackers are of French origins, it is simply impossible to tell based on this fact. 

LeChiffre ransomware provides a non-typical ransom note through which criminals try to convince the victims that they are not scammers. As evidence, they offer to send them 1-2 encrypted files that contain less than 5 MB of space but no relevant information. Additionally, the crooks offer to send the victims a free decryption tool after six months if the users do not want to transfer any money. However, there is no need to pay a ransom or wait as the free decryption software has already been released by Emsisoft researchers.

The encryption is made by encrypting the first and last 8192 bytes of the file and then attaching the malicious key to the file as a 32-byte blob. Continuously, LeChiffre ransomware developers might use remote servers to store both encryption and decryption keys so that the secret codes would be accessible only for the criminals themselves. After the encryption process is finished, LeChiffre ransomware leaves a note on the infected computer in the format of a .html or .txt file that usually looks like this:

Your important files (photos, videos, documents, archives, databases, dackups, etc.) which were crypted with the strongest military cipher RSA1024 and AES. No one can't help you to restore files without our decoder. Photorec, RannohDecryptor, etc repair tools are useless and can destroy your files irreversibly. If you want to restore files – send e-mail to decrypt.my.files @ gmail.com with the file “_secret_code.txt” and 1-2 encrypted files less than 5MB as *.doc *xls *jpg but not database (*.900 *.001 etc). Please use public mail yahoo or gmail.
You will receive decrypted samples and our conditions how you'll get the decoder. Follow the instructions to send payment.
P.S. Remember, we are not scammers. We don't need your files. If you want, you can get a decryptor for free after 6 month. Just send a request immediately after infection. Al data will be restored absolutelly. Your warranty decrypted samples.
Secret code:
%secret_code%

Continuously, LeChiffre virus is delivered through payload that looks like a usual executable file and ends up with a copy of itself (in the format of a .jpg component) in the Trash section. After that, the hackers can choose what type of files to encrypt no matter if it is all of them or just a specific number of data. Besides, the ransomware can lock all active data-storing sources not only the ones that are placed on the computer system directly.

Nevertheless, LeChiffre ransomware replaces the sethc.exe executable in the C:\Windows/system32\sethc.exe with cmd.exe to open a backdoor on the infected machine system. The original sethc.exe file can be executed by the user clicking the SHIFT key on his keyboard for 5 times in a row when the criminals can call the placed cmd.exe file and launch specific commands automatically by gaining remote access to the machine with no login data required.

Another interesting thing about LeChiffre ransomware is that the malware records relevant data about the machine's geographic locations and provides the country code number on the left of the graphical user interface. Additionally, criminals initiate remote communication by using an HTTP protocol and deliver important information through a Command & Control server.

The name “LeChiffre” might have different relations. Cybersecurity specialists claim that the word is French and translated means “the number”, however, if we emphasize the word as a verb or noun “chiffer”/”chiffrement”, it means encrypting/encryption. Another theory says that LeChiffre ransomware was named after the name of the villain called “LeChiffre,” meaning “the Cypher”, featured in the first James Bond movie.^[4] The latter franchise inspired many cybercriminals.

If you see the ransom note or files encrypted with the .LeChiffre appendix added to each filename, it is actual proof that LeChiffre ransomware has attacked your computer. We do not recommend paying the ransom^[5]. You cannot trust the cybercriminals – there’s no guarantee that they will put any efforts to help you get the files back. Plus, a decryptor for this ransomware has been created already. 

However, you can also restore your files in case you have backup copies of them^[6]. If you have such copies of your files, all you need to do is to remove the LeChiffre ransomware from your computer. Keep in mind that you should store backups on an EXTERNAL backup drive, because some viruses can reach your online data cloud storage and infect files that are stored there, too. Also, after you force the virus to vanish, you can try to fix the damage that has been left by the malware by employing a tool such as FortectIntego.

LeChiffre ransomware attacked banks and a pharma company in Mumbai. The newer version uses a password-guessing technique

Since the appearance of the ransomware in mid-summer 2015, the authors have not departed the ransomware market. Unfortunately, the virus has been continuously developed. Small business with a wider network of servers happens to be the preference of LeChiffre malware.

Additionally, news reports regarding LeChiffre virus activities have been flooding the cybersphere back in 2016 when the malware aimed to attack the Indian banks and a pharma company.^[7] The criminals have demanded a ransom of 1 BTC on every infected machine which could have related in huge monetary losses (up to millions of dollars) if the ransom demands would have been taken seriously.

It has been also known that the newer version of LeChiffre ransomware utilizes a password-guessing technique. In other words, if you have been using a standard and a weak code such as “password123″^[8], the cyber villains easily hack into the server remotely and then download the main payload of the ransomware. Therefore, netizens are advised to use long passwords comprised of characters and numbers. Password managers may also be a solution.

Distribution techniques for ransomware viruses

Security experts from Virusai.lt^[9] claim that ransomware viruses spread through different channels. Some cybercriminals find ways how to distribute the malware via Remote Desktop Ports that do not have password protection or include weak passwords that are very easy to guess.

Crooks also prefer disguising their threats in spam emails. Users are deceived with the fake notifications supposedly sent from delivery companies such as FedEx/DHL, banking companies, or even law enforcement institutions. Once a suspicious message with the intention to infect users is received, people are encouraged to click on an infectious link or open a questionable attachment, mostly, an executable or word document.

Continuously, ransomware can be distributed through exploit kits, various outdated services, and products, other malicious threats such as trojans, or on p2p networks such as The Pirate Bay that provide various software cracks and have very low protection. 

Avoid clicking on suspicious hyperlinks, downloading bogus products from the Internet, opening unknown emails and you will have a great chance of avoiding ransomware viruses. Besides, get an antivirus program that will ensure full system protection during your computing work.

Remove LeChiffre ransomware and restore files

According to the note of .LeChiffre file extension virus, you can get your files back for free after 6 months. This is unlikely to happen. There is no guarantee that the crooks will return the undamaged or all files after this period. Do not waste time and initiate automatic LeChiffre ransomware removal. Install and update your security applications, e.g. SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Don't forget that your system might need an extra repair with FortectIntego or similar software to restore damaged Windows system files.

Only when the full elimination is completed, you can proceed to file recovery steps. In case, you encounter any problems and cannot remove LeChiffre ransomware, the below instructions will help you regain access. You can boot your machine in Safe Mode with Networking or activate System Restore to disable malicious changes.

Once LeChiffre is completely gone, you can start thinking about data recovery possibilities. Below you will find a few methods that might help you to restore your files back to their primary states. Additionally, we have added the original decryption tool released by Emsisoft at the end of this article that you might want to give a try to.