Locks ransomware – malware that encrypts files and then asks for $1,500 ransom for its retrieval
Locks ransomware is a new version of the Xorist ransomware family. It encrypts all personal data on an infected computer, renames it by appending all original filenames with a .locks extension, and creates two types of ransom notes which contain the same message.
Within these notes (a pop-up window titled “Error” and text file HOW TO DECRYPT FILES.txt), developers of Locks virus state their demands, the main of which is to pay $1,500 in cryptocurrency Bitcoin for a decryption key that would allegedly decipher the encrypted data.
If the ransom isn't forwarded to their wallet crypto-wallet (1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX.) within 48 hours, the amount will be doubled every two days. The threat actors are urging the victims to contact them through a provided email address – frankhans@tuta.io.
| name | Locks ransomware |
|---|---|
| type | Ransomware, file-locking virus |
| Family | Xorist |
| Appended file extension | .locks |
| Ransom note | Text file HOW TO DECRYPT FILES.txt and a pop-up window. Both bearing identical messages. |
| Ransom amount | The original price is $1500. If the ransom isn't paid within 48 hours, it doubles. |
| Criminal contact details | frankhans@tuta.io |
| Criminal Crypto-wallet | 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX |
| Virus removal | This, and any other kind of malware, should be eliminated with anti-malware software to ensure it's done properly |
| system repair | We highly recommend performing a system repair with the FortectIntego system tune-up tool, having in mind that cryptoviruses usually mess up Windows Registry and other core files and settings |
Ransomware is on the rise, and cybersecurity experts predict that damages caused by this type of malware could increase to $20 billion this year.[1] We've already spotted some new variations of ransomware this year, including Atek, Ziggy, Qlkm, 2021, and many more.
Developers of Locks ransomware, and cybercriminals, in general, should never be trusted as they are criminals for a reason. The transferred ransom only encourages them to increase their attacks and develop more sophisticated crypto-malware that are harder to detect. All in all, these are the most probable scenarios after a victim meets the demands of the assailants:
- Threat actors disappear, and no decryption tool is sent.
- The decryption tool doesn't work.
- Criminals ask for more money.
- Instead of the promised tool, additional malware is sent.
Other ways of regaining access to your data are possible. You just have to not panic and not make any rash decisions. The only right thing to do is to remove Locks ransomware from the infected machine as soon as possible.
It would be best if you did that with anti-malware software that would automatically locate, isolate, and eliminate the virus with all of its components. If there's no anti-malware software installed on the device, we recommend downloading reliable tools such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes and letting them do the work.
In some cases, cryptovirus alter Windows Registry, host files, and other key system settings and files to establish persistence and prolong their unwelcomed stay by disabling anti-malware tools. In that case, Locks ransomware removal might be done in Safe Mode with Networking (see a detailed guide on that at the bottom of this article) if the virus tampers with the security software's functionality.
When the ransomware-type infection is removed from your device, it's time to take care of those corrupted system settings. The best results are achieved when system repair tools such as the FortectIntego software is used to scan the whole system and let it do the rest.
Message from the creators of Locks file virus in the ransom note states:
All your personal FILES are now ENCRYPTED!
Don't worry, you can get back all your files
I don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data
but that is not helping me. 🙂
So temporary all of your files are mine now until you pay the service cost of recovering them.
If yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.
You have got 48 hours exactly, before you lost your files forever.
Failing which, the price to recover double with every 48 hours passing!
Rest assured, all your files will be recovered once payment is received.The Price to get all things back to normal : US$ 1500
My BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbXEmail : frankhans@tuta.io
Spam emails – still one of the most popular ways for cybercriminals to deliver their creations
Cybercriminals have many weapons when we're talking about malware delivery options – Remote Desktop Protocol attacks, drive-by downloads,[2] file-sharing platforms, etc. But our research shows that one of the most popular techniques used by the threat actors is spam emails.
They send out tens of thousands of these emails all over the world during so-called spam campaigns. These letters usually urge the users to either click on a hyperlink that opens a malicious site where the virus can be downloaded without even pushing anything or download an infected attachment that contains the virus payload file.
If either of these options is taken, and the virus bypasses anti-malware software filters, then some sort of malware infection is guaranteed. We're here to help, so use this short list of guidelines to determine whether the email is sent from a legitimate source or cybercriminals:
- Companies usually don't make grammatical mistakes.
- Email sender's domain must exactly match the one of a company.
- Companies don't push their clients into visiting their sites or opening unsolicited attachments.
- Legitimate companies don't request sensitive information to be sent via email.
- Companies know their clients' names, so they address you directly, instead of “Dear member”, “Dear Client”, etc.
Detailed Locks ransomware removal guide
More and more people suffer from ransomware attacks every day. Computer users should upgrade their cybersecurity level by acquiring professional, trustworthy anti-malware software such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes to watch their backs whenever they're connected to the internet.
If you were unlucky enough and got your device infected by Locks ransomware – all is not lost. Other family members have already been deciphered, meaning that their encrypted files are easily decryptable with free software available on the Emisoft webpage.
If you've tried their decryption software but it didn't work – there's still hope. The good guys are constantly working on helping ransomware victims by creating decryption tools for various cryptoviruses. Before Locks ransomware removal, export all encrypted data to offline storage, and check back on us as we update our readers with the latest news.
Once that's done, you're ready to remove Locks ransomware from your machine. Launch anti-malware software and perform a full system scan. Let the application to find, isolate, and eliminate the virus. When it's finished, experts[3] recommend performing a system repair with the powerful FortectIntego system tune-up tool to restore all corrupted system files and settings.
Was this guide helpful?
Be the first to comment