Decrypter for Alpha Ransomware Lets Victims Recover Files for Free

[Exterminator]

Content source

http://news.softpedia.com/news/decrypter-for-alpha-ransomware-lets-victims-recover-files-for-free-503581.shtml

A team of security researchers have discovered, analyzed and then cracked a new ransomware version known as Alpha Ransomware, spotted during the past week.

The ransomware works in a strange way compared to other versions. When it infects a victim, Alpha will selectively encrypt files.

On the system drive (usually, C, it will only target 249 file types in the Desktop, My Pictures, and the Cookies folders. On other drives, it will encrypt all files except INI files. On shared folders it will encrypt all files it finds.

Crooks asks for $400 in iTunes gift cards
The ransomware uses AES-256 encryption to lock files, and then it appends each file's name with the .encrypted extension.

After the encryption process ends, the ransomware adds a ransom note in text format in each folder where it encrypted files, changes the user's wallpaper (see image attached to article), and then deletes itself.

According to the ransom note, the crook asks for $400 worth of iTunes gift cards. If used improperly, these gift cards can be traced back to the crook and reveal his real identity. Bitcoin is not used at all, which is an anonymous crypto-currency, currently untraceable.

This is the third ransomware in the last week that was seen asking for gift cards instead of Bitcoin. Researchers previously discovered the Cyber.Police and the TrueCrypter ransomware families. TrueCrypter is also decryptable.

Alpha Ransomware decrypter available for download
Security researcher Michael Gillespie is the one that crafted the Alpha Ransomware decrypter after spotting a weakness in its encryption routine.

The security researchers that analyzed and broken down Alpha Ransomware are Katja Hahn, S!Ri, and MalwareHunterTeam. The decrypter is available for download via the Bleeping Computer website.

The decrypter has a high detection rate on VirusTotal for the Razy trojan. We reached out to MalwareHunterTeam and Mr. Gillespie about this issue, who said it was because of the source code obfuscation. Michael Gillespie, MalwareHunterTeam, and Bleeping Computer have provided many other ransomware decrypters in the past, which did not show up as infected on VirusTotal scans, so you can rest assured they're the good guys.

 

[DJ Panda]

If users use their brains, update software, and run legit programs with virus, exploit and malware protection you can keep your computer safe most of the time.