Pashka ransomware: what it is and how to remove it

From our report of Jan 2020 · not reviewed since

More from our earlier report on Pashka ransomware

• Ransomware affects numerous system files and alters a variety of Windows settings in order to work as intended.
• Even after malware is terminated, corrupted system files might make Windows crash or malfunction.

From our report of Jan 2020 · not reviewed since

Pashka ransomware - a computer infection that uses AES encryption algorithm to lock all personal files on the system

Pashka ransomware is a file locking malware that was first spotted in early January 2020 by security researcher Amigo-A. While no samples have yet been uploaded, the virus already attacked several users and encrypted all pictures, MS Office documents, PDFs, videos, and other files located on the system utilizing the AES encryption method.

As a result, victims are unable to access their data and are left in a difficult situation where, without backups, they need to pay a ransom to cybercriminals to obtain Pashka ransomware decryptor.

Besides encrypting all files on the host machine and appending .pashka extension, the virus also drops a ransom note named HELP_ME_RECOVER_MY_FILES.txt, which explains to users what happened to their files and how to recover them. Victims are asked to pay 0.03 BTC into a provided wallet and then contact hackers via unlockransomware@protonmail.com.

However, doing so is not recommend, as threat actors might never send the required software to decrypt files, consequently leaving victims with nothing. Instead, users should focus on Pashka ransomware removal and alternative methods for data retrieval, which we provide below.

While there are more ransomware strains discovered recently that target businesses and public entities for larger ransom sums, it seems like Pashka ransomware developers went for regular users, which means that targets are most likely chosen randomly. For that, malicious actors behind the threat can choose a variety of methods to infect victims, including:

Once the infection is triggered, Pashka virus places an executable file (a random name for that is typically used) into the % TEMP% folder and also extracts several other files into Users and Desktop folders. During this process, the Windows registry is altered, Shadow Volume Copies deleted, Startup recovery disabled, and all the other necessary preparations for file encryption process are executed.

The encryption process typically lasts just a few seconds, up to a few minutes depending on various factors, such as system configuration, HDD size, cipher key length, etc. After that, each of the files is appended with .pashka extension, so an example of a locked file would look as follows - picture.jpg.pashka, which would also not have a typical icon used by .jpg format, and simply appear blank.

Pashka ransomware then drops the following text file on the desktop and other locations, which reads:

It is true that a unique key is required to decrypt Pashka ransomware encrypted files, but it is also true that hackers are not the people you could put your trust in - they can simply take your money and vanish, proceeding to infect other victims in the meantime.

Nevertheless, some users might find contacting crooks as the only way to recover their important data. If that is the case, you have been warned.

If you decide not to pay criminals, but you have no backups available, you should make a copy of the encrypted files before you remove Pashka ransomware from your machine with anti-malware software, as data may become permanently corrupted in the process.

After that, you can try using alternative methods to recover your files. Note that ransomware may also damage or corrupt system files, which would result in its instability and crashes.

• Exploits and software vulnerabilities
• Spam email attachments and hyperlinks
• Backdoors
• Malicious websites
• Software cracks, etc.

From our report of Jan 2020 · not reviewed since

Use security precautions when dealing with online content

Unlike other malware, ransomware is only stealthy before the infection stage.

Once the malicious executable is launched, there is not much that can be done to protect files on the system, although shutting down the machine immediately might prevent the encryption of some data. Another trait of ransomware is that it does not revert the encrypted files back to normal, even after its removal - that is precisely what makes this type of infection especially dangerous.

While infected users might find it insignificant how they got infected with ransomware, this information can save them from repeating the mistake in the future.

As a general rule, attack vectors include some type of social engineering, although the infection routine is mostly initiated by users who are simply unaware of security precautions or are simply ignorant. Therefore, it is important to ensure that comprehensive security precautions would be practiced in order to avoid the devastating consequences of ransomware infection.

Here are a few tips from security experts:

• Always apply all the software updates to Windows and other programs installed on your PC immediately;
• Employ next-gen security software that uses machine learning and other advanced malware detection methods;
• Enable Firewall to prevent network intrusions;
• Never open spam email attachments that ask to enable the macro function or click on hyperlinks;
• Use strong passwords for all your accounts by using alphanumeric characters or use a password manager;
• Do not download pirated software installers and cracks/keygens/loaders;
• Configure your Remote Desktop connection: never leave it open (default TCP port), protect it with a secure password, and turn it off when it is not needed;
• Backup all your files on a regular basis to negate the effects of ransomware.

From our report of Jan 2020 · not reviewed since

Backup the encrypted files, delete Pashka ransomware and only then proceed with data recovery process

As previously mentioned, you should not remove Pashka ransomware straight away.

Some file locking malware strains are programmed to exit the system as soon as the initial encryption process is finished, while others remain on the system and keep encrypting the incoming data. Some ransomware was also found to insert additional components that steal personal data (for example, some Djvu virus variants), or come with other malware, such as Trojans.

The only way you can check for all this is by scanning your machine with powerful anti-malware software - you can use tools like or and perform a full system scan in Safe Mode with Networking.

However, if you are not planning on paying criminals and do not have backups of Pashka virus encrypted files, you should ensure you make a copy first, as ransomware research teams are constantly working on deciphering new malware and providing decryption tools for victims.

[GI=method-1]In case Pashka ransomware is difficult to remove in normal mode, you can access Safe Mode with Networking to bypass malware's functionality.

[GI=method-2]Use System Restore to delete viruses:

This tool might be able to retrieve at least some of your files from your hard drive. Note, the less you use your PC after the infection, the bigger the chances are to recover your files.

Make use of Windows Previous Versions feature

This can only work if you had System Restore enabled prior to the attack.

ShadoeExplorer might help you in some cases

This tool might recover all your files in cases where the Pashka ransomware virus failed to delete Shadow Volume Copies.

No decryption tool is currently available