Sigma ransomware virus. How to remove? (Uninstall guide)

Sigma – ransomware that continues spreading and encrypting files in 2018

Questions about Sigma ransomware virus

• Sigma virus removal request  11/03/18 1

Sigma is a ransomware-type cyber threat that uses RSA-2048 encryption and appends a random 4-character file extension to the targeted data. Following data encryption, it drops the ReadMe.html or ReadMe.txt file which redirects to ransom payment website. The most common way to get infected with this malware is to open a malicious email attachment. Though, security experts warn that new malspam campaign spreading the virus was noticed in March 2018.

At the moment, Sigma virus has a low detection ratio. It is spreads disguised as Automated Universal MultiBoot UFD Creation Tool.exe file or Guid.exe.bin. It is detectable as Trojan.Agent.CPOW,^[1], Trojan.Ransom.Shade!1.A988 (CLASSIC), etc. The former sample is only identified by one security tool as Trojan.Generic.bcnxb^[2] file. Observing the former alternative trojan name and the very design of the ransom note, it is possible to assume its relation to Shade malware.

Furthermore, the virus also reads technical computer details, particularly RDP protocols. It also creates a counterfeited system process to disguise its activity. Interestingly, the malware has anti-sandboxing features. It maneuvers to escape the detection. If the occupied system happens to be natural OS environment rather than a virtual machine, the malware then connects to http://ip.api/json.txt^[3] and send the data about victim’s geolocation. Hence, Sigma ransomware removal is needed to fix the damage to the device.

However, the main task of the ransomware is to encrypt files on the affected computer. During the process, it places ReadMe.html file which directs users to an online payment site. It briefly informs users about the encrypted data. It instructs them to download TorBrowser and access the specific .onion page.^[4] The latter presents a page entitled a “Sigma Ransomware” and asks to enter machine GUID. It also includes a link to download the GUID Helper.

After the encryption is finished, the malware also changes the desktop background. The message urges users to find “Readme” file or visit the mentioned .onion link and enter the personal ID number indicated on the ransom note. On the desktop, Sigma ransomware also leaves GUID.exe and GUID.txt files.

Speaking of the payment site, it consists of several pages. One of them indicated the exact time when your files were encrypted. It demands $1000 for the decryption software. If payment is not remitted within 7 days, the ransom amount will double. On the same .onion page, victims are encouraged to create Bitcoin wallet.

Sigma ransomware analysis revealed that unlike standard ransomware, this crypto-malware does not provide an email address but instead suggests using Xamp account. It also includes Pidgin Installation Guide link. Therefore, they contact the perpetrator via Sigmaxxx@jabb.im^[3] address.

Instead of complying with the demands, remove Sigma ransomware. You can do so with the assistance of Reimage or Malwarebytes Anti Malware. You might need to boot your computer into Safe Mode. Further instructions are indicated below. Unfortunately, Sigma ransomware decryptor is not available yet. However, you can try alternative recovery methods that are also given at the end of the article.

⇦⇨

Slide 1 of 10

Fake Craigslist emails were noticed spreading Sigma ransomware in March 2018

Authors of Sigma virus launched a new malspam campaign to spread malware payload. This time crooks sent fake emails from Craiglist that contained password-protected Word or RTF documents. Of course, these documents include ransomware executable. 

Users who open an infected email and enter the password are asked to enable content on the document. As soon as it's done, a malicious VBA script is launched. Immediately after the click on “Enable Content Button,” a password-protect RAR is downloaded and extracted to %Temp% folder. This folder contains svchost.exe file which executes ransomware.

Fake scanned files include malware executable

While the malware presents detailed GUI and payment sites, its distribution campaign is quite distinctive than other crypto-malware. Sigma malware is delivered in a spam email attachment “Scan_[number].doc” file.

The email message briefly states the that the receiver is going to be billed [money amount] on their personal Mastercard balance right away. In order to avoid it, they should review the attachment. It also includes a passcode. However, entering the code activates Sigma hijack. Interestingly, though the malware is written in English, it was spotted in Greek^[5] domains.

Besides spam emails, users should be also vigilant while downloading applications. Pay attention to what source you download it and whether it is certified. Pay attention to the installation wizard stages to deselect optional and unnecessary add-ons. Now let us move to Sigma ransomware fix section.

Instructions on how to remove Sigma ransomware

Sigma removal is needed to clean the computer and use it normally again. Unfortunately, virus elimination does not help to get back encrypted files. However, you can try third-party software or use backup as soon as your computer is ransomware-free.

You may do so with the assistance of malware elimination tool, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware. In case you cannot launch to remove Sigma virus, perform System Restore or restart the computer in Safe Mode. Only after the eliminate the malware, proceed to data recovery.

Reimage is recommended to uninstall Sigma ransomware virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
More information about this program can be found in Reimage review.

read press mentions »