Paymen45 ransomware: what it is and how to remove it

From our report of May 2020 · not reviewed since

Paying attention to particular details can significantly affect the security of a PC

File locking viruses are possible one of the most devastating types of malware due to their functionality.

Once files are encrypted, only a unique key, which is generated during the infection process, can decipher them and allow users to re-access them.

Unfortunately, this key is sent off to a Command & Control server that is controlled by the attackers, and they are not willing to giveaway it for free. While sums can vary, regular consumers are typically asked for lesser sums than corporations, where ransoms can reach hundreds of thousands of dollars.

Ransomware authors also came up with another devastating tactic (started by Maze ransomware gang) to make users and companies to pay ransoms. Before encrypting data, they copy everything located on the network/server/computer and place copies to their own server. This allows the attackers to threaten victims by claiming that the data will be publicly exposed if the demands will not be met on time.

Thus, getting infected with this type of infection can cause various negative consequences, such as permanent data loss on private information exposure to malicious parties. To avoid such outcomes, it is crucial to take care of cybersecurity and not ignore industry experts' advice.

First of all, the computer should be equipped with comprehensive security software that has real-time protection feature and can protect the whole network from intrusion. However, careful online behavior is just as important as security tools, so users should also:

• backup data on a regular basis;
• apply Windows and application updates as soon as new patches are released;
• never download software crackers or pirated program installers;
• employ VPN for RDP connections and limit the access to individuals who actually need it;
• use secure passwords for Remote Desktop connections;
• never reuse passwords for different accounts;
• do not click on random links on social media or other platforms;
• never allow spam email attachment to run macro function;
• scan unknown files with anti-malware software or online scanning services like Virus Total.

From our report of May 2020 · not reviewed since

More from our earlier report on Paymen45 ransomware

• readme.txt or readme-warning.txt is dropped on the desktop, as well as other places on the machine
• Before removing the virus from the computer, users who do not have backups should make a copy of all encrypted files and only then use anti-malware software to eliminate the infection safely (note: it will NOT recover your files)

From our report of May 2020 · not reviewed since

Known Paymen45 ransomware versions

While first sightings of Paymen45 virus were spotted on April 30, two different versions have been released within the first two weeks of its operation - g8R4rqWIp9, and KJHslgjkjdfg.

The naming is based on the file extension that is generated to encrypt data, although researchers believe that the string is random and can consist of 10 randomly-generated alphanumeric characters.

Once inside the system, g8R4rqWIp9 ransomware performs several changes to the Windows system and encrypts all data on local and networked drives. This way, PDF files, MS Office documents, databases, and other files are appended with .g8R4rqWIp9 extension, and can no longer be accessed.

Once that is complete, users are asked in readme.txt file to download the Tor browser and visit the http://paymen45oxzpnouz.onion/ address for further communication. In some cases, users were also provided a contact address - repairhost1@protonmail.com email.

We do not recommend contacting or paying g8R4rqWIp9 ransomware authors, and instead of performing g8R4rqWIp9 virus removal with anti-malware, and then using alternative methods for data recovery.

KJHslgjkjdfg ransomware showed up just a week later after the initial Paymen45 release. Users reported that all their personal files were appended with .KJHslgjkjdfg file extension and even NAS backups were encrypted as well.

In other words, if malware manages to penetrate a company, it will most likely to encrypt all servers and machines connected to the same network. If that is the case, each of the infected computers and other devices should be immediately isolated from the network.

One of the malware samples analyzed by researchers was an output.159342821.txt file, which is highly likely to trigger the infection. It is detected by various security solutions under the following names:

Also, KJHslgjkjdfg ransomware is using a different ransom note - readme-warning.txt, contents of which slightly vary from the initial version:

• Gen:NN.ZexaF.34108.kq0@aOdJGsfG
• Trojan.Encoder.31793
• Win32.Packed.Kryptik.5Y4AR0
• VirTool:Win32/Obfuscator.KK!MTB
• Packed-GBC!7668CABB5A3F
• Trojan.MalPack.GS, etc.

From our report of May 2020 · not reviewed since

Paymen45 ransomware is the dangerous much-evolving crypto-extortion threat

Paymen45 ransomware is a data locking virus that stems from Oled/Makop malware strains.

It was first identified in late April 2020, when multiple users started to complain about the infection, which prevents them from opening pictures, music, documents, databases, and other files located on local or networked/NAS devices.

Soon after the infiltration, the Paymen45 virus uses a combination of AES and RSA encryption algorithms to lock files and appends a randomized extension to each. Currently, there are two different versions identified by the researchers: g8R4rqWIp9 and KJHslgjkjdfg.

After encrypting data, Paymen45 ransomware also drops a ransom note readme.txt or readme-warning.txt (depending on the version), which explains what happened to users' files and asks them to download a Tor web browser in order to be able to visit a dark web onion webpage.

Users are asked to provide the personal ID, and then they are provided with a personal ransom size, which can be as low as $10 in some cases. Threat actors behind this ransomware also threaten to publicly disclose the stolen files if the ransom is not paid.

Since Paymen45 ransomware belongs to a relatively new malware strain, there are no clear indications of what methods the attackers sue for its propagation. While some ransomware families, such as the notorious Djvu, use a single attack vector, most cybercriminals resort to multiple techniques when it comes to malicious payload delivery.

Thus, the ransomware might be delivered in one (or multiple) of the following ways:

Most of these techniques can usually be prevented by using security software and other precautionary measures - you can find more tips in our article below. As for now, you should focus on ransomware virus removal and data recovery. Do not try to restore data without cleaning the machine beforehand. It can affect the recovery and even damage your data significantly.

Before performing data encryption, Paymen45 ransomware firs needs to prepare the system for the process. Thus, the malware modifies the Windows registry database by setting new keys for persistence, creates new processes that help malware function during the infection, starts a new service, deletes Shadow Volume Copies to prevent easy data recover, etc.

Once the preparations are complete, Paymen45 ransomware begins the data encryption task. In most cases, users do not notice how the process is performed, and only realize that something odd happened after they try to open a personal file or see a ransom note.

Malware targets most common file types, such as .pdf, .sql, .doc, .rar, .jpg, and many others. After the process, each of the files receives one of the following extensions:

• g8R4rqWIp9
• KJHslgjkjdfg
• another randomized string

Paying cybercriminals is not recommended, as they might not contact you after the payment. We suggest not paying the attackers unless it is an absolute last choice and none of the alternative methods we provide below work for you.

Note that you should make a copy of your hard drive, including the registry database and the encrypted files (unless you have backups - then you can remove the ransomware as soon as possible).

To eliminate the malware, use powerful security tools, such as or . Nevertheless, some file locking viruses eliminate themselves after encrypting files, so your anti-malware may not find anything if that is the case.

However, keep in mind that other malicious software might have been installed along with Paymen45 ransomware, so a scan is a mandatory process. After you are sure that the infection is gone, you can also use to remediate Windows computer and fix virus damage.

• Spam email attachments or embedded hyperlinks;
• Fake updates or scam websites;
• Drive-by downloads and software vulnerabilities;
• Brute-forcing combined with weakly protected RDP (Remote Desktop) attacks;
• Illegal program installers and software cracks;
• Etc.

From our report of May 2020 · not reviewed since

Eliminate the threat by removing all Paymen45 ransomware virus related files

As previously mentioned, some crypto-malware might erase themselves after the file encryption process, so Paymen45 ransomware removal might not be necessary.

However, since there might be other payloads installed on your system (ransomware is sometimes distributed with info-stealers like AZORult), you should still perform a full system scan with a powerful anti-malware program.

However, you should not remove the malicious virus before you back up all the files that were encrypted, along with the Windows registry database. If you do not perform these backups, malware might reinstall itself even after its termination in some cases.

In case the Paymen45 virus is tampering with your security software, you can access Safe Mode with Networking, and perform the scan from there. After that, you can proceed with data recovery methods we provide below (note that there is no guarantee that any of them will work, but you should try them out regardless).

[GI=method-1]If malware is interfering with your security software, go to Safe Mode with Networking as explained below:

Data recovery software cannot decrypt files that were affected by ransomware. Instead, it tries to extract working copies from within the hard drive. However, the more the infected computer is used after the infection, the less chances there are for such software to successfully retrieve data.

Windows Previous Versions Feature might be useful to some users

Windows Previous Versions Feature is a built-in method that can help some users to recover files one-by-one.

ShadowExplorer might work for you

No decryption tool is currently available