Gero Ransomware

Recently, malware analyzers have come across a brand-new ransomware threat called Gero Ransomware. Nowadays, even less-skilled cyber crooks can build data-locking Trojans like the Gero Ransomware, as there is a practice of borrowing the code of an already established ransomware threat and only slightly alter it.

Propagation and Encryption

This is the case with the Gero Ransomware, as once cybersecurity researchers studied this threat they found out that it is a variant of the widely popular STOP Ransomware. It is not yet known how the authors of the Gero Ransomware are propagating their creation. There are speculations that mass spam email campaigns alongside bogus software updates and fake pirated copies of popular applications may be at play regarding the propagation of the Gero Ransomware. A scan will be performed as soon as the Gero Ransomware gains access to your system. This is done so that the threat can locate the files, which it was programmed to target. Often, the list of file types that ransomware threats target is very long so that the data-locking Trojan is guaranteed to cause maximum damage. Once the files of interest are located, the Gero Ransomware will start encrypting them. When a file undergoes the encryption process of the Gero Ransomware, its name will be altered. The Gero Ransomware appends a '.gero' extension at the name of each affected file. This means that an audio file called 'lino-points.mp3' will be renamed to 'lino-points.mp3.gero' once the encryption process is completed.

The Ransom Note

Then, the Gero Ransomware will drop a ransom note that goes by the name '_readme.txt.' In the note, the attackers make it clear that the ransom fee is $980. However, they state that every user that contacts them within 72 hours of the attack will receive a 50% discount and will have to pay $490 instead. The creators of the Gero Ransomware offer to unlock one file free of charge as proof that they are in possession of a functioning decryption key. There are two emails given out as a means of contacting the attackers – 'gorentos@bitmessage.ch' and 'gerentoshelp@firemail.cc.'

You should avoid contacting cyber crooks. There is nothing good coming out of it. A safer approach in this sticky situation would be to download and install a legitimate anti-spyware solution and have it wipe off the Gero Ransomware from your computer. Next, you can try recovering some of the files using a third-party data-recovery application.