SUMMON ransomware – a cryptovirus developed for Bitcoin extortion
SUMMON ransomware is a file-locking virus that encrypts all personal victim data and generates ransom notes which demand to forward Bitcoins to the assailants for a decryption tool. Also, encrypted files are renamed in a complex manner. Original filenames are prepended with one of the attackers' email addresses summonunlock@gmail.com along with an appointed victim ID (both in brackets) and then appended with a .SUMMON extension.
If a victim had a file named a.pdf, it would now look like [SummonunLock@gmail.com][id=XXXXXXXX]a.pdf.SUMMON (Xs' stand for user ID). Two ransom notes appear when that's finished, one as a text file #ReadThis.TXT, and one as an HTML document, #ReadThis.HTA.
If you see any symptoms that your device might be infected with SUMMON ransomware virus, please don't panic and make rash decisions. It's not the end of the world. We have searched into the activity of the ransomware and other cybersecurity specialists' research shows that it is possible to remove the threat. This article contains a summary, distribution methods, data recovery options, and removal methods of this computer infection.
| name | SUMMON ransomware |
|---|---|
| type | Ransomware, cryptovirus, file-locker |
| Distribution | Spam emails, file-sharing platforms, RDP attacks |
| Appended file extension | Renamed files look like this – [SummonunLock@gmail.com][id=XXXXXXXX]original_filename.SUMMON |
| Ransom note | #ReadThis.HTA, #ReadThis.TXT |
| Criminal contact details | summonunlock@gmail.com, summonunlock@mailfence.com. Two more possible addresses – Dude@mailfence.com, Summon@nuke.africa |
| Malware removal | Use dependable anti-malware software to remove SUMMON ransomware virus from all infected devices |
| System repair | Powerful tools like the FortectIntego app should be used to repair any and all system damage that was caused during the encryption |
Ransomware has been lurking in the shadows of the internet for a long time now, and it won't stop spreading any time soon. There are ransomware families and rogue ransomware. It can target regular people as well as big corporations. New versions are developed daily. Here are a few examples of the latest ones:
All of them might use different encryption techniques,[1] distinct ransom notes, various appending methods, and extensions. Still, all of their goals are the same – frightening their victims into submitting to the assailants' demands. That's done by using various scare tactics in the ransom notes.
Here's what message developers of SUMMON ransomware send to their victims:
Your SERVER/COMPUTER is encrypted by us !_
Hello Admin/Guest![ENCRYPTER] => All your data is encrypted by us ..
[ENCRYPTER] => Your Server Unique ID : [-]
[ENCRYPTER] => Do you want to decrypt your data?
[ENCRYPTER] => To trust us, first send us a 100-200 KB file,
we will decrypt it to build trust for you.[AFTERTRUST] => What should you do after building trust?
Help
(
All your data is encrypted,
If your data is important and you want to decrypt it,
You must pay the bitcoin amount set by us,
Send a message to our emails first, after pricing, us and your trust,
Do a Google search to buy bitcoins,
For example: “Buy bitcoins in rubles”.
After purchasing Bitcoin, you must
transfer the Bitcoin to our wallet,
After payment, the decryption tool will be sent to you
along with how to execute it properly
)ENCRYPTER@server ~ $ To contact us, first send a message to our first email.
[FiRsT Email:] SummonunLock@gmail.com
ENCRYPTER@server # If your email is not answered after 24 hours, our email may be blocked.
So send a message to our second email.
[SeCoNd email:] SummonunLock@mailfence.comKing Of Ransom
SUMMON Ran$omW4rE
Usually, a few files' free decryption is guaranteed to prove that a necessary decryption tool exists (including SUMMON ransomware virus). Sometimes a video of the decryptor in action is added. Victims are urged not to use any third-party software to unlock the files, as the only way to do that rests in the cybercriminals' hands.
In many cases, that might be true, but agreeing with the assailants' demands is the worse thing any SUMMON ransomware victim can do. The send money motives the cybercriminals to expand their whole illegal operation and funds their research and development. The only way to stop ransomware from spreading is if victims stop paying the ransom.
Therefore, remove SUMMON ransomware from your devices. If you don't have the required tools, we recommend using either SpyHunterCombo Cleaner or MalwarebytesMalwarebytes to automatically finish this task. Please remember to keep the virus databases of either of these apps updated, and they might prevent such mishaps in the future.
Ransomware-type viruses tend to mess with system files and settings, that could lead to various abnormal system behavior. So to finish SUMMON ransomware removal, users will have to use another tool. IT experts from Virusai.lt[2] recommend entrusting this task to the powerful FortectIntego system repair tool.
Watch out for unsolicited attachments, and hyperlinks in emails
threat actors behind ransomware have many spreading options, including Remote Desktop Protocol attacks, deceptive ads, file-sharing platforms, and so on. Although, our research suggests that one of the most popular ransomware distribution options is spam emails.
Ransomware payload files can be hidden in either infected email attachments or hyperlinks. Cryptoviruses might be hidden as practically any file type, including .zip, .rar, .xlsm, .exe, .docx, .pdf, etc. As soon as either of the two options are clicked and opened, a virus might find its way onto the device and start encryption.
Users have to be aware that cybercriminals are always on the hunt. Emails that urge users to install software updates, or download a crucial document, are most likely phishing emails. Watch for grammatical mistakes, strange domains, and other irregularities to identify a spam email.
Instructions for SUMMON file virus removal from Windows computers
If you got your device infected with SUMMON ransomware virus, it's your anti-malware software fault, not yours. The main thing is not to panic. Don't even look at the ransom note. Download and install professional anti-malware tools such as SpyHunterCombo Cleaner and MalwarebytesMalwarebytes that will help you eliminate this threat.
It's worth mentioning that SUMMON ransomware removal won't decrypt your files. There could be third-party tools that you could try (displayed at the bottom of this page). If none of them work, extract all essential files to an external storage device and wait for a public decryption key or tool to be made available.
Use the aforementioned tools to remove SUMMON ransomware from the infected device automatically. Once that's done, run a full system scan with the FortectIntego app to fix any system irregularities, such as corrupted registry and other core settings/files. If left unattended, these changes might result in crashes, freezes, BSoD,[3] and other system issues.
Was this guide helpful?
Be the first to comment