How to remove XPan ransomware virus

XPan ransomware strikes again with new encryption features

Xpan virus operates as a file-encrypting virus which is affiliated to Team XRat or Xorist ransomware family^[1]. Its key characteristics include appending .one file extension and providing one@proxy.tg email address. Much attention to this virus group was attributed last year^[2]. The current version is not new. It has been detected in September 2016. One of its distinctive features is that it was devised by Brazilian hackers. It uses AES-256 encryption algorithm. However, due to bugs in the programming code, it is decryptable. Its distribution technique sparks interest as well. Hardly it is spread via spam emails and exploit kits, in fact, it is spread manually. Once the malware is placed on a system, it would encrypt a wide range of personal documents and then mark them with .____xratteamLucked and .one file extensions. It is known that the malware would also examine the default language of the infected device in HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE^[3]. Thus, it suggests that it targets only certain countries. More information about its distribution and Xpan removal sections is provided in further questions.

Taking into account that the ransomware is loaded manually into the device^[4], it is able to locate and identify other geographical details which allow pinpointing the exact location of a victim. The malware operates in the form of a trojan — Trojan-Ransom.Win32.Xpan. Specifically, the AES-256 public key is used for encrypting data. This encryption strategy is more elaborate in contrast to previously employed TEA (Tiny Encryption Algorithm), thus, it falls into the category of troublesome threats. Nonetheless, IT specialists have found a way to decrypt the files without the necessity for victims to pay the money.

Interestingly, that the programming code contains hints and messages for IT experts. Among the lines, there are just notes as “eusoudejesus“ meaning “I am from Jesus“. In addition, it also refers to celebrities and the electronic game which was popular in the 1990s which might suggest the identity of cyber crooks. During the encryption, XPan malware also copies its files into the registry editor and initiates changes via Command Prompt. Victims are expected to contact the crooks and then receive the decryption key. Nonetheless, whether users receive the files after transmitting the money remains still an answered question. The malware contains striking similarities to the variation of AiraCrop – version of NMoreira. Furthermore, the ransom message does not contain clear indication how much the crooks require. Individual cases reveal that the prevalent requirement is 0.3 BTC (approximately $377). Thus, it would be wiser to remove XPan rather rely on crooks’ conscience.

Transmitting the malware

Its distribution method clearly stands out from other infections. Unlike other crypto-malware, this virus is installed manually via RDP (Remote Desktop Protocol) brute force assaults^[5]. In short, it operates as the protocol for Windows Remote Desktop. Its key function is to allow remote administrative access to the computer. Thus, the brute force includes scanning for vulnerable IT ranges and RDP servers. Likewise, the cyber villain accesses the device as a “administrator.” It is also known that this variation prefers targeting business companies. However, it would be futile to think that the malware would not shift its attention to the broader virtual community. In that case, in order to limit the possible risk XPan hijack, install an anti-spyware, for instance, FortectIntego or MalwarebytesMalwarebytes. They are also practical in dealing with less destructive but more sneaky PUPs.

The eradication guide of Xpan ransomware

Time plays a significant factor in dealing with malware. Thus, launch malware removal utility and start XPan removal. If you notice that some system functions ceased working, use the below instructions. Only when this procedure is completed, you may advance towards data decryption stage. Do not attempt to remove Xpan virus manually as you may only leave more vulnerabilities for future cyber attacks.