'.crypted000007 File Extension' Ransomware
The '.crypted000007 File Extension' Ransomware is an encryption ransomware Trojan that is part of a large family of ransomware Trojans known as Troldesh and Shade. The '.crypted000007 File Extension' Ransomware was first observed on October 27, 2018 and is very similar to the other variants in the Troldesh and Shade ransomware families. The main way in which the '.crypted000007 File Extension' Ransomware is delivered to victims is via corrupted spam email attachments.
How the '.crypted000007 File Extension' Ransomware Carries Out Its Attack
The '.crypted000007 File Extension' Ransomware is often delivered in the form of a Microsoft Word file with planted macro scripts that download and install the '.crypted000007 File Extension' Ransomware onto the victim's computer. Once the '.crypted000007 File Extension' Ransomware is installed, it uses a strong encryption to make the victim's files inaccessible. The '.crypted000007 File Extension' Ransomware targets the user-generated files in its attack, which may include files with the following file extensions:
.jpg, .jpeg, .raw, .tif, .gif, .png, .bmp, .3dm, .max, .accdb, .db, .dbf, .mdb, .pdb, .sql, .dwg, .dxf, .cpp, .cs, .h, .php, .asp, .rb, .java, .jar, .class, .py, .js, .aaf, .aep, .aepx, .plb, .prel, .prproj, .aet, .ppj, .psd, .indd, .indl, .indt, .indb, .inx, .idml, .pmd, .xqx, .xqx, .ai, .eps, .ps, .svg, .swf, .fla, .as3, .as, .txt, .doc, .dot, .docx, .docm, .dotx, .dotm, .docb, .rtf, .wpd, .wps, .msg, .pdf, .xls, .xlt, .xlm, .xlsx, .xlsm, .xltx, .xltm, .xlsb, .xla, .xlam, .xll, .xlw, .ppt, .pot, .pps, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .sldx, .sldm, .wav, .mp3, .aif, .iff, .m3u, .m4u, .mid, .mpa, .wma, .ra, .avi, .mov, .mp4, .3gp, .mpeg, .3g2, .asf, .asx, .flv, .mpg, .wmv, .vob, .m3u8, .dat, .csv, .efx, .sdf, .vcf, .xml, .ses, .qbw, .qbb, .qbm, .qbi, .qbr , .cnt, .des, .v30, .qbo, .ini, .lgb, .qwc, .qbp, .aif, .qba, .tlg, .qbx, .qby , .1pa, .qpd, .txt, .set, .iif, .nd, .rtp, .tlg, .wav, .qsm, .qss, .qst, .fx0, .fx1, .mx0, .fpx, .fxr, .fim, .ptb, .ai, .pfb, .cgn, .vsd, .cdr, .cmx, .cpt, .csl, .cur, .des, .dsf, .ds4, .drw, .eps, .ps, .prn, .gif, .pcd, .pct, .pcx, .plt, .rif, .svg, .swf, .tga, .tiff, .psp, .ttf, .wpd, .wpg, .wi, .raw, .wmf, .txt, .cal, .cpx, .shw, .clk, .cdx, .cdt, .fpx, .fmv, .img, .gem, .xcf, .pic, .mac, .met, .pp4, .pp5, .ppf, .nap, .pat, .ps, .prn, .sct, .vsd, .wk3, .wk4, .xpm, .zip, .rar.
The '.crypted000007 File Extension' Ransomware marks the files it targets with the file extension '.crypted000007.' The '.crypted000007 File Extension' Ransomware delivers a ransom note in the form of a text file named 'README1.txt.' The '.crypted000007 File Extension' Ransomware's ransom note is written in both Russian and English. The following is the English version of the '.crypted000007 File Extension' Ransomware's ransom note:
'All the important Files on your conputer were encrypted.
To decrypt the files you should send the following code:[random characters]
to e-mail address pilotpilot688@gnail.con .
Then you will receive all necessary instructions.
All the attempts of decryption by yourself will result only in irrevocable loss of your data.
If you still want to try to decrypt them by yourself please make a backup at first because
the decryption will become impossible in case of any changes inside the files.
If you did not receive the answer from the aforecited email for more than 48 hours {and only in this case!)
use the Feedback forn. You can do it by two ways:
1) Download Tor Browser from here:
h[tt]ps://www.torproject[.]org/download/download—easy.html.en
Install it and type the following address into the address bar:
h[tt]p://cryptsen?fo43rr6[.]onion/
Press Enter and then the page with feedback form will be loaded.
2) Go to the one of the following addresses in any browser:
h[tt]p://cryptsen?fo43rr6[.]onion.to/
h[tt]p://cryptsen?fo43rr6[.]onion.cab/'
Protecting Your Data from Threats Like the '.crypted000007 File Extension' Ransomware
The best protection against threats like the '.crypted000007 File Extension' Ransomware is to have file backups stored on the cloud or an external memory device. Having file backups ensures that computer users can restore their data easily after an attack. Computer users should refrain from paying the '.crypted000007 File Extension' Ransomware ransom or contacting the criminals responsible for the '.crypted000007 File Extension' Ransomware attack.
