Threat Database Ransomware JobCrypter Ransomware

JobCrypter Ransomware

By GoldSparrow in Ransomware

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 2
First Seen: February 15, 2016
Last Seen: March 6, 2020
OS(es) Affected: Windows

The JobCrypter Ransomware is an encryption ransomware Trojan that is used to target computer users in France. Encryption ransomware Trojans like the JobCrypter Ransomware are designed to encrypt the victim's files, and then demand the payment of a ransom to provide the decryption key. Essentially, the JobCrypter Ransomware takes the victim's files hostage. The JobCrypter Ransomware appends the extension LOCKED to each file the JobCrypter Ransomware encrypts. This makes the encrypted files easy to recognize. The JobCrypter Ransomware drops TXT files on the victim's computer with information about the ransom payment. If the computer users do not pay the JobCrypter Ransomware ransom, the affected files cannot be recovered. PC security researchers advise computer users to maintain proper backups of their computers using the cloud, or an external memory device to avoid becoming a victim of the JobCrypter Ransomware and similar encryption ransomware attacks.

Why You should Avoid Been Infected by the JobCrypter Ransomware and Similar Threats

The JobCrypter Ransomware demands a ransom of 300 Euros, to be paid using PaySafeCard. Most modern ransomware Trojans use BitCoin or similar methods for payment, but PaySafeCard, Ukash, and similar methods were favored by the previous generation of threats. The JobCrypter Ransomware provides the victim with information on how to perform the payment, as well as the offer to decrypt one small file as a way to prove that they do have the decryption key. The files encrypted by the JobCrypter Ransomware cannot be decrypted currently without access to the decryption key. Because of this, the best protection against threats like the JobCrypter Ransomware is to make a backup of all your files regularly.

The JobCrypter Ransomware is very similar to numerous other infections, including CryptoWall and TeslaCrypt. In fact, these infections are all virtually identical, changing only slightly in the encryption method and ransom payment. Many ransomware Trojans like the JobCrypter Ransomware have started to become ever more similar, in part due to the rise of the RaaS or Ransomware as a Service industry, which provides third parties with ransomware components to distribute, taking as payment part of the ransoms collected by using these threat attacks.

Recovering from a JobCrypter Ransomware Infection

The following is the ransom note that has been associated with the JobCrypter Ransomware. This is simply a French version of common ransom notes that have been associated with similar encryption ransomware Trojans:

Bonjour, nous somme des êtres humains sans emplois, en cherche pas les problèmes,
en veux juste nourrir nos familles, nous vous demandant de ne pas faire des bêtises avec nous,
Parce que ce n'est pas bien pour vous,
Nous avons crypté tous vos fichiers en utilisant un Algorithme personnel et nous demandons de nous Payer une rançon de 300 EURO pour débloquer vos fichiers,
Nous vous garantissons le déblocage totale de vos fichier et ne plus jamais entendre parler de nous, moyen de

Payement: Le Payement:
peut s'effectuer en utilisant les cartes de Paysafecard disponible partout en France,
voici le lien pour trouver rapidement les points de ventes les plus proche de chez vous:
hxxps://wm.paysafecard.com/fr-fr/acheter/trouver-des-points-de-vente/

Toute demande de déblocage sans Payer sera automatiquement rejeté,
Nous acceptons seulement les cartes de 50 EURO et 100 Euro,
veuillez envoyer les codes des cartes à l'un des e-mails suivant:

geniesanstravailleeoutlook.fr
geniesanstravailleeyahoo.fr
geniesanstravailleegmail.com

N'oubliez pas de préciser l'identifiant de votre ordinateur sur le titre du mail, voici votre identifiant: 0E66C244
En gis de bonne volonté et pour vous prouver que ce n'est pas une arnaque,
Nous allons décrypter un fichier gratuitement pour vous,
veuillez nous envoyer un de vos fichiers crypté en pièce-jointe à l'un des courriel cité au-dessus
et n'oubliez pas de préciser aussi l'identifiant de votre ordinateur pour que nous puissions localiser votre clé de
décryptage parmi celle de nos clients. vous aurez une repense avec le code de déblocage dans le même jour du payement.
veuillez nous excuser pour le désagrément

As part of its infection process, the JobCrypter Ransomware will target certain specific file types on the victim's computer, searching for these files and then encrypting them using its encryption algorithm. This allows the infected computer to remain functional enough to display the ransom note even after the victim's files have been encrypted. This has made threats like the JobCrypter Ransomware superior to previous generations of ransomware, which would shut down access to the infected computer entirely.

Trending

Most Viewed

Loading...