How to remove RSAUtil ransomware virus

RSAUtil – a ransomware that offers file decryption for a payment in Bitcoin

RSAUtil ransomware is a file-locking virus^[1] which first appeared on world wide web in April 2017. It uses a complicated encryption algorithm known as AES, which, once applied, renders people's files useless^[2]. The ransomware is written in Delphi^[3] and targets English-speaking PC users in particular. The original version appended the file extension after encryption the following way: . [Ransom_email] .ID [victim's ID] . The ransom note is dropped into every folder which is called How_return_files.txt. The first version urged users to contact hackers via helppme@india.com and  hepl1112@aol.com.

There is a wide list of extensions^[5] used by RSAUtil. The versions that emerged in January 2018 used .GORILLA and .VENDETTA file extensions. However, previously the virus used .[alexjer554@gmx.com] .ID [victim_ID] and .[batary5588@gmx.com] .ID [8 random digits] extensions to mark encrypted files. 

It seems that its developers win not stop distributing and improving the virus. Virus keeps coming back with new and improved versions – the latest one was spotted by security expert Amigo-A^[6] on 13th of May 2018. This version RSAUtil virus asks users to contact criminals using Tizer78224@gmx.de, Tizer78224@india.com or Tizer77234@protonmail.com email. Please read more about different variants below.

The crypto-virus encrypts all personal files, including .avi, doc,  .docx, .htm, .html, .jpeg, .jpg, .mpeg, .php, .png,  .rar, .txt, .xls,  .xlsx, .zip and many others. To decrypt them, users need a key which generated to each person individually. Thus, if a ransom is paid and the personal key is given, it will not be useful for anybody else. These decryptors are stored on a remote server and are only accessible to hackers. However, security experts recommend not to contact cybercrooks and remove RSAUtil virus instead.

The contact information may differ according to the RSAUtil ransomware version. Currently, criminals demand victims to pay $750 ransom. Victims are urged to exchange their money to Bitcoin cryptocurrency and transfer the redemption equal to $750 to 1CshTLvSfDrN1ATmC7vBNTkay1MtsA6KVs BTC wallet. 

No matter how many changes have been made when improving RSAUtil virus, the ransom note name stays the same — How_return_files.txt. The note gets dropped on the infected device to inform the victims about what has happened to their files and offer some recovery suggestions.

WARNING!!!
Your ID xxxxxxxxxx
OUR FILES ARE DECRIPTED
Your documents, photos, database, save games and other important data was encrypted.
Data recovery the necessary interpreter. To get the interpreter, should send an email to helppme@india.com or hepl1112@aol.com.
In a letter to include Your personal ID (see the beginning of this document).
In response to the letter You will receive the address of your Bitcoin wallet to which you want to perform the transfer.
When money transfer is confirmed, You will receive the decrypter file for Your computer.
After starting the programm-interpreter, all Your files will be restored.
Attention! Do not attempt to remove a program or run the anti-virus tools.

Extortionists have a wide list of email addresses used to scam people out of their money:

• helppme@india.com;
• hepl1112@aol.com;
• batary5588@gmx.com 
• batary5588@india.com 
• batary5588@protonmail.com 
• filegorilla1388@gmx.de
• filegorilla1388@india.com
• filegorilla1388@protonmail.com
• panzergen552@gmx.de
• panzergen552@protonmail.com
• panzergen552@india.com
• vendetta553@gmx.de 
• vendetta553@india.com
• vendetta553@protonmail.com
• robocript@gmx .us 
• robocript@india.com 
• robocript@protonmail.ch
• alexjer554@gmx.com
• alexjer554@india.com
• ursa2277@gmx.com
• ursa2277@yahoo.com
• ursa2277@india.com
• ursa2277@bk.ru
• ziz777@gmx.com
• ziz777@india.com
• some@mail.ru
• vine77725@gmx.de 
• vine77725@india.com 
• vine77725@protonmail.com 
• jonskuper578@india.com 
• jonskuper578@gmx.de 
• jonskuper578@protonmail.com 
• fox2278@india.com 
• fox2278@protonmail.com 
• fox2278@gmx.de
• lion7872@protonmail.com
• lion7872@gmx.de
• lion7872@india.com
• Tizer78224@gmx.de
• Tizer78224@india.com
• Tizer77234@protonmail.com

Hackers behind RSAUtil ransomware are undoubtedly trying to convince users into paying the ransom for their files, but our expert team recommends victims to eliminate this ransomware infection from the computer instead. This way, you will not support the wrongdoers and protect yourself from being robbed of your money. Keep in mind that RSAUtil removal should be your priority. After that, you can use our recovery instructions to recover your encrypted files.

If you have not been hit by RSAUtil yet, we highly recommend you reevaluate the security of your device and make backup copies of your files. 

Having backups ^[7], you will calmly bypass any ransom demands and recover your files without spending a penny. Please keep in mind, though, that the storage drives on which you keep your backups must be unplugged from the device, otherwise, the virus may affect them too. So, before you try to recover your data, take care of RSAUtil removal first.

If your PC was compromised, we recommend scanning your device with antivirus software like FortectIntego to clean up every last bit of ransomware from your computer. Then, you may try to recover your files following professional software we introduce below the article.

RSAUtil versions listed

As we already mentioned, there multiple versions of the virus and it keeps coming back with periodically. Unfortunately none of the variants are decryptable yet, adn the only way to get files back is from a backup or by paying the ransom (we highly discourage users from paying crooks!). Nevertheless, you will fine a complete list of RSAUtil versions below.

•  some@mail.ru. Appeared in mid May 2017 and appended . [Ransom_email] .ID [victim_ID] file extension;
•  ziz777@gmx.com. First spotted late May 2017; appended [Ziz777@india.com] .ID [random_digits8] file extension;
•  ursa2277@gmx.com. Spotted August 2017; added URSA.ID[victim_ID] extension;
•  alexjer554@gmx.com. Was found in early October 2017; appended  [alexjer554@gmx.com] .ID [victim_ID] file extension;
• batary5588@gmx.com. First appeared late October 2017;
• robocript @gmx.us. Was first spotted in November 2017 and added file extension [robocript@india.com] – ID [victim_ID] 
• panzergen552@gmx.de. Found by researchers in early December 2017;
• vendetta553@gmx.de. Was first discovered in mid-December 2017 and added .ID [victim_ID ].VENDETTA extension to each of the files;
• Filegorilla1388@gmx.de. came at the same time as .VENDETTA but added .ID [victim_ID] .GORILLA appendinx instead;
• vine77725@gmx.de. Was first spotted before the new year of 2018. Hackers asked $2000 in BTC to be paid into 166asTTzXjy8xaw1feimY7s1xwozyy8ACi wallet;
• panda7499@gmx.de. First introduced late January 2018;
• jonskuper578@india.com. Security researchers spotted this version mid-February 2018. It encrypted files using      .[ID425xxxxx] (example) file extension;
• fox2278@india.com. This variant emerged in early March and used .[ID231xxxxxx] appendinx;
• lion7872@protonmail.com. Discovered early April 2018;
• Tizer78224 gmx.de. The latest version was spotted in early May.

Virus distributed via mail spam and RDP attacks

The main techniques used by this crypto-ransomware are these:

• The described ransomware is known to be distributed via RDP^[5] attacks. The hacker gets into remote desktop services illegally and uploads a pack of files on them. The package consists of several files, including a configuration file that is responsible for ransomware execution and clearly, the ransomware itself.
• Another technique used by fraudsters is malspam. Infected email attachments carrying documents supposedly relevant to the user is the bait that unsuspecting users still take very often. Scammers usually show outstanding skills when it comes to crafting fake emails.

Please remember that the emails you may receive from governmental institutions or other trustworthy-looking sources may not always be what you expect them to. In fact, you should be especially careful with them because names of such organizations are very often used as marionettes for executing malicious scams.

It is likely that ransomware may arrive on the computers disguised as attached tax return information, invoices or other documents, so our suggestion is to be careful when downloading them and executing them on your computer.

Eliminate RSAUtil ransomware virus professionally

If you want to perform a successful RSAUtil removal, remember that you will not do it any way better than by employing professional antivirus software and allowing it to go through the entire infected system automatically.

The antivirus tools will remove RSAUtil and all of its undesirable components from your computer, giving you the freedom to enjoy your regular activities instead of spending hours, hunting down malicious files.

Nevertheless, even the automatic ransomware removal may be challenging. For instance, the virus may block your security utility from running the system scan. If this happens, you will have to follow the manual virus decontamination procedure and try running the system scan again.