LIZARD ransomware – cyber infection that might result in complete data compromise
LIZARD ransomware is a malicious program that attacks Windows computers by locking all non-system files, such as pictures, videos, music, documents, etc. Malware, which belongs to Flamingo virus family, uses sophisticated encryption tactics by utilizing both AES and RSA[1] algorithms, which also appends each of the files with .LIZARD extension, as well as additional stings, containing the user ID and the contact email. Suchlike files lose distinctive icons and become fully inaccessible.
While the .LIZARD files are unavailable, it does not mean that they are corrupted. It becomes apparent as soon as malware delivers a ransom note #READ ME.TXT – the attackers demand payment in Bitcoin in order to recover a unique decryption software which, once used, could unlock all the files on the computer.
But before that, victims are asked to send threat actors their personal ID and a test file for decryption via the LizardInfo@yandex.ru or LizardSup@tutanota.com emails. Nonetheless, we do not recommend contacting the attackers because they might not deliver the required decryption tool. Check out the alternative methods we provide below instead and take care of LIZARD ransomware removal first.
| Name | LIZARD ransomware |
|---|---|
| Type | Ransomware, data locking malware, cryptovirus |
| Malware family | Lizard ransomware |
| Encryption method | A combination of RSA and AES is used to lock all non-system and non-executable files on the host machine |
| File extension | Malware uses a three-part extension, which consists of a contact email, user ID (appended before the file name), and a .LIZARD extension. Example of an encrypted file: [LizardInfo@yandex.ru][id=460B22EA]picture.jpg.LIZARD |
| Ransom note | #READ ME.TXT |
| Contact | LizardInfo@yandex.ru or LizardSup@tutanota.com |
| File Recovery | If no backups are available, recovering data is almost impossible. Nonetheless, we suggest you try the alternative methods that could help you in some cases – we list them below |
| Malware removal | Perform a full system scan with powerful security software, such as SpyHunterCombo Cleaner |
| System fix | Malware can seriously tamper with Windows systems, causing errors, crashes, lag, and other stability issues after it is terminated. To remediate the OS and avoid its reinstallation, we recommend scanning it with the FortectIntego repair tool |
Flamingo ransomware, which is a relatively new strain, first showed up in September 2020. This is the first version which uses .LIZARD extension. While it is yet unknown which actors are behind the strain, it seems like they are determined to keep going, as already four versions have been released within just a couple of months. It is not surprising since the ransomware business is extremely lucrative,[2] and many criminals are keen to grab some cash.
As soon as the LIZARD virus gains access to a Windows machine, it begins changing the way it operates. One of the main goals of the threat is to ensure that the file encryption process is successful, so it immediately attempts to break into Windows defenses and delete Shadow Copies. The virus also drops several hundred malicious files on the system and changes the Windows registry, as well as several other sectors.
While malicious files can be deleted during LIZARD ransomware removal, some system damage sustained during the attack could remain. Hence, security experts[3] recommend using FortectIntego or another repair tool that might return your Windows back to normal without having to reinstall it.
As soon as malware finishes with the system changes, it begins the encryption process. Most viruses of such type simply append a standalone extension or add additional components to each of the files. However, this malware uses a little bit different method – it appends the user ID and the email before the file name, followed by .LIZARD extension.
Data encryption process only lasts a moment, and a ransom note is delivered soon after, which reads:
———-[ All your data is encrypted by a strong encryter L!zarD ]———-
=========================== # Unique ID : 460B22EA
=========================== # E-mail : LizardInfo@yandex.ru================================================================================
” PLEASE BE CAREFUL ” :
if your data is important to you, And you want to make a payment, be sure
to send us a test file first(3 Mb),And make sure we have the ability to
open your files(Decrypt test files).So first send the test file to prove
that we can decrypt your files, Then make a payment (Buy BTC) and receive the
decryption tool (Send Decrypter).
================================================================================
If you do not receive a reply after sending us an email,
please send an email to the second email address.
second E-mail : LizardSup@tutanota.com
================================================================================
As evident, the attackers want to make victims trust them, as they offer free test decryption solution. However, we recommend you do not trust hackers, as they might take your money and never deliver the decryption tool. Instead, remove LIZARD ransomware with SpyHunterCombo Cleaner, MalwarebytesMalwarebytes, or another reputable security software and attempt to recover data in different ways – we provide a few solutions below.
Ransomware distribution methods: learn to protect yourself
Many users who get infected with ransomware are quite shocked. This is because most ransomware victims never encountered such an infection before. This also makes many believe that they can recover .LIZARD files as soon as they scan their computers with anti-malware. Unfortunately, that is far from the truth, as crypto-malware after-effects remain present even after the virus is deleted. In other words, you won't get your files back just because you remove the infection from your computer (although this is a necessary procedure regardless). If no backups are available, data recovery possibilities are very limited, unfortunately.
Therefore, it is best to avoid ransomware infiltration in the first place – here are some tips that you should take into consideration each time you turn on a PC connected to the internet:
- Install powerful anti-malware software and keep it updated;
- Never download software cracks or pirated program installers;
- Do not allow documents attached to unknown emails to run macros on your system (“Allow Content” feature);
- Update your operating system and all the installed software regularly;
- Use secure and complex passwords for all your accounts and never leave your WiFi opened to everyone;
- Backup your most important files on a regular basis – this is the easiest way to recover from a ransomware attack.
Get rid of LIZARD virus and only then proceed with data recovery
If you have no backups available, it is important you do not proceed with LIZARD ransomware removal immediately. First, you have to make sure you copy all of your most important encrypted files to a separate medium (locked data does not hold any malicious code, so it is safe to move); otherwise, the files might be permanently damaged by security software. This is also useful if you later decide to pay the ransom after all – keep in mind it is an absolute last resort, and the risk of losing your money prevails!
As soon as that is done, remove LIZARD ransomware with powerful anti-malware software, such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. If, for some reason, your security software is struggling to work due to the presence of malware, access Safe Mode with networking as explained below and perform the scan from there. Also, use FortectIntego to remediate Windows system files, as you might face crashes, errors, or other stability issues otherwise. Finally, follow the data recovery instructions below.
Was this guide helpful?
Be the first to comment