UmbreCrypt is the name of a new ransomware that uses AEM encryption methods to lock files on users computers. If your computer is infected with this ransomware, most of your files will be inaccessible and you will be asked to pay the ransom to retrieve them.
Unfortunately, at the time there are no ways to decrypt locked files, but some cyber security researches announced that they are working on a decrypter project for UmbreCrypt ransomware.
Right now, if your computer is infected and files encrypted, the firs thing you should do is to remove UmbreCrypt from your computer. Even though it won’t help you to retrieve your files, but virus like UmbreCrypt can infiltrate other malware into your system so it has to be done.
This ransomware can be removed either manually or automatically, so it’s up to you which removal method to choose. Since it’s much easier to do it automatically, we suggest to go for this removal method. Simply download reliable anti-malware application, such as Spyhunter or Malwarebytes, install it on your computer and then run a full scan of all files stored on your hard drive. One of these apps should detect and remove UmbreCrypt automatically just in a few moments. If your computer is infected with some other malware, it will detect and remove it too.
However, if for some reasons you don’t want to download any additional anti-malware software, you can eliminate UmbreCrypt manually by your own. This process might be complicated, so we have developed a step-by-step UmbreCrypt manual removal guide – scroll down below this article and check it out. Try to complete all steps correctly and you will be able to remove UmbreCrypt manually by your own.
To learn more about specific features of UmbreCrypt please continue reading this article. If you have some questions regarding this topic, feel free to ask them in the comments section below and we will do our best to answer them all.
About UmbreCrypt ransomware
UmbreCrypt has a scan engine and uses it to scan your hard drive. They are looking for certain files extensions in order to encrypt them. After the encryption, additional phrase (umbrecrypt_ID_[victim_id]) will be added to all extensions of encrypted files. As far as we know UmbreCrypt is targeting these files:
.sql, .mp4, .7z, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .unrec, .scan, .sum, .t13, .t12, .qdf, .gdb, .tax, .pkpass, .bc6, .bc7, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, .wallet, .wotreplay, .xxx, .desc, .m3u, .flv, .js, .css, .rb, .png, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .ppt, .xlk, , .xls, .wps, .doc, .odb, .odc, .odm, .odp, .odt, .dx, .mrw, .nef, .tiff, .bd, .tar.gz, .mkv, .bmp, .dot, .xml, .pps, .dat, .ods, .qba, .qbw, .ini.$$$, .$db, .001, .002, .003, .113, .73b, .__a, .__b, .ab, .aba, .abbu, .abf, .abk, .acp, .acr, .adi, .aea,.afi, .arc, , .as4, .asd, .ashbak, .asv, .asvx, .ate, .ati, .bac, .backup, .backupdb, .bak2, .bak3, .bakx, .bak~, .bbb, .bbz, .bck, .bckp, .bcm, .bdb, .bff, .bif, .bifx, .bk1, .bkc, .bkup, .bkz, .blend1, .blend2, .bm3, .bmk, .bpa, .bpb, .bpm, .bpn, .bps, .bup, .caa, .cbk, .cbs, .cbu, .ck9, .cmf, .crds, .csd, .csm, .da0, .dash, .dbk, .dim, .diy, .dna, .dov, .dpb, .dsb, .fbc, .fbf, .fbk, .fbu, .fbw, .fh , .fhf, .flka, .flkb, .fpsx, .ftmb, .ful, .fwbackup, .fza, .fzb, .gb1, .gb2, .gbp, .ghs, .ibk, .icbu, .icf, .inprogress, .ipd, .iv2i, .jbk, .jdc, .kb2, .lcb, .llx, .mbf, .mbk, .mbw, .mdinfo, .mem, .mig, .mpb, .mv_, .nb7, .nba, .nbak, .nbd, .nbf, .nbi, .nbk, .nbs, .nbu, .nco, .nda, .nfb, .nfc, .npf, .nps, .nrbak, .nrs, .nwbak, .obk, .oeb, .old, .onepkg, .ori, .orig, .oyx, .paq, .pba, .pbb, .pbd, .pbf, .pbj, .pbx5script, .pbxscript, .pdb, .pqb, .pqb-backup, .prv, .psa, .ptb, .pvc, .pvhd, .qbb, .qbk, .qbm, .qbmb, .qbmd, .qbx, .qic, .qsf, .qualsoftcode, .quicken2015backup, .quickenbackup, .qv~, .rbc, .rbf, .rbk, .rbs, .rdb, .rgmb, .rmbak, .rrr, .sav, .sbb, .sbs, .sbu, .sdc, .sim, .skb, .sme, .sn1, .sn2, .sna, .sns, .spf, .spg, .spi, .sps, .sqb, .srr, .stg, .sv$, .sv2i, .tbk, .tdb, .tibkp, .tig, .tis, .tlg, .tmp, .tmr, .trn, .ttbk, .uci, .v2i, .vbk, .vbm, .vbox-prev, .vpcbackup, .vrb, .wbb, .wbcat, .wbk, .win, .wjf, .wpb, .wspak, .xbk, .xlk, .yrcbck, .~cw
After the encryption, you will be asked to contact cyber criminals via email and send them one encrypted file, so they would decrypt it and send back to you as a prove that they can unlock your files. You will also be provided with instructions how to pay the ransom.
Once encryption is done, you will notice a message on your desktop. It says:
Attention! All your main files were encrypted! ID:****
Your personal files (documents, databases, jpeg, docx, doc, etc.) were encrypted, their further using impossible. Encryption was made using a unique public key RSA-2048 generated for this computer.
To decrypt your files you need to buy a software with your unique private key. Only our software will allow you decrypt files.
Note:
-You have only 72 hours from the moment when an encryption was done to buy our software with a loyal price, the payment amount will be increased multiple after the laps of 72 hours.
-Any attempts to remove this encryption will be unsuccessful. You cannot do this without our software with your key.
-Do not send any emails with threats and rudeness to us. Example of email format: “Hi, I need a decryption of my files. My ID number is …”
(instead of three dots should be your ID number which could be found in the same folder where the encrypted file, also your ID number is shown on this picture)
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact your within 12 hours.
For you to be sure, that we can decrypt your files – you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Do not believe hackers and do not pay the ransom – even if you pay it, there are no guarantees that you will retrieve your files. The only way to get back your encrypted files is to restore them from a copy of your hard drive. However, to be able to do that, you have to have a valid copy of your hard disk that was mane previous the date of this infection. Instructions how to perform system restore can be found here: https://www.2-viruses.com/how-to-do-a-system-restore.
Update: the decrypter is now available at here: link. You can download it for free and successfully decrypt your files.