CoronaCrypt Ransomware

Countless cybercriminals from all around the globe have been using the Coronavirus pandemic to propagate all sorts of schemes and malware. One of the latest examples of this is the CoronaCrypt Ransomware.

Propagation and Encryption

The CoronaCrypt Ransomware is a threat that will likely affect all your data once it compromises your computer. This data-locker goes after documents, spreadsheets, presentations, images, audio files, videos, archives, databases and many other filetypes. When this nasty Trojan locks a file, it adds a new extension to its name. The CoronaCrypt Ransomware appends a '.Encrypted' extension to the names of all the affected files. This means that a file that you had named 'tip-taps.mp3,' will be renamed to 'tip-taps.mp3.Encrypted' once the CoronaCrypt Ransomware applies its encryption algorithm. Malware experts are not sure how is the CoronaCrypt Ransomware being distributed exactly. It is likely that the authors of this Trojan are using spam emails to propagate it. Cybercriminals often use phishing emails to distribute online tactics or various threats. Usually, they would either use a macro-laced file or a corrupted link. Other propagation methods that may be involved in spreading the CoronaCrypt Ransomware may be malvertising campaigns, fraudulent social media pages, bogus software updates, torrent trackers, etc.

The Ransom Note

After carrying out the encryption process, the CoronaCrypt Ransomware will proceed with the attack by dropping a ransom note on the user's computer. The ransom message appears as a text file titles' How_To_Restore_Your_Files.txt,' as well as a new pop-up window. The CoronaCrypt Ransomware' ransom note is rather lengthy. In the ransom message, the attackers state that the victim should contact them via email – ‘u.contact@aol.com.' They do not mention the ransom fee, but they make it clear that they want it paid in Bitcoin. The creators of the CoronaCrypt Ransomware offer to unlock up to five files for free, provided that they are no larger than 10Mb and do not contain important data.

It is not a good idea to cooperate with the creators of the CoronaCrypt Ransomware. Paying the ransom fee offers you no guarantees that you will be provided with the decryption key you need to restore your files. Make sure you remove the CoronaCrypt Ransomware from your PC via a reputable, up-to-date anti-malware solution.