Scarab-Gefest Ransomware
The Scarab-Gefest Ransomware Trojan is threatening ransomware that is part of the Scarab family of ransomware. There are countless variants in this ransomware family, all carrying out typical encryption ransomware attacks. The Scarab-Gefest Ransomware, like most encryption ransomware Trojans from the Scarab family, is designed to take victims' files hostage and then demand a ransom payment in exchange for the captured data.
How the Scarab-Gefest Ransomware Attacks a Computer
The Scarab-Gefest Ransomware is being distributed through corrupted spam email attachments currently. These will often take the form of documents with embedded macro scripts that install the Scarab-Gefest Ransomware onto the victim's computer. Once installed, the Scarab-Gefest Ransomware searches for the user-generated files and encrypts them using the AES and RSA encryptions. The Scarab-Gefest Ransomware attack marks the files it encrypts with the file extension '.CRABSLKT,' which is added to each affected file's name. Threats like the Scarab-Gefest Ransomware target in these kinds of attacks the files exemplified below:
.jpg, .jpeg, .raw, .tif, .gif, .png, .bmp, .3dm, .max, .accdb, .db, .dbf, .mdb, .pdb, .sql, .dwg, .dxf, .cpp, .cs, .h, .php, .asp, .rb, .java, .jar, .class, .py, .js, .aaf, .aep, .aepx, .plb, .prel, .prproj, .aet, .ppj, .psd, .indd, .indl, .indt, .indb, .inx, .idml, .pmd, .xqx, .xqx, .ai, .eps, .ps, .svg, .swf, .fla, .as3, .as, .txt, .doc, .dot, .docx, .docm, .dotx, .dotm, .docb, .rtf, .wpd, .wps, .msg, .pdf, .xls, .xlt, .xlm, .xlsx, .xlsm, .xltx, .xltm, .xlsb, .xla, .xlam, .xll, .xlw, .ppt, .pot, .pps, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .sldx, .sldm, .wav, .mp3, .aif, .iff, .m3u, .m4u, .mid, .mpa, .wma, .ra, .avi, .mov, .mp4, .3gp, .mpeg, .3g2, .asf, .asx, .flv, .mpg, .wmv, .vob, .m3u8, .dat, .csv, .efx, .sdf, .vcf, .xml, .ses, .qbw, .qbb, .qbm, .qbi, .qbr , .cnt, .des, .v30, .qbo, .ini, .lgb, .qwc, .qbp, .aif, .qba, .tlg, .qbx, .qby , .1pa, .qpd, .txt, .set, .iif, .nd, .rtp, .tlg, .wav, .qsm, .qss, .qst, .fx0, .fx1, .mx0, .fpx, .fxr, .fim, .ptb, .ai, .pfb, .cgn, .vsd, .cdr, .cmx, .cpt, .csl, .cur, .des, .dsf, .ds4, , .drw, .eps, .ps, .prn, .gif, .pcd, .pct, .pcx, .plt, .rif, .svg, .swf, .tga, .tiff, .psp, .ttf, .wpd, .wpg, .wi, .raw, .wmf, .txt, .cal, .cpx, .shw, .clk, .cdx, .cdt, .fpx, .fmv, .img, .gem, .xcf, .pic, .mac, .met, .pp4, .pp5, .ppf, .nap, .pat, .ps, .prn, .sct, .vsd, .wk3, .wk4, .xpm, .zip, .rar.
The Scarab-Gefest Ransomware will deliver its ransom note in a text file named 'HOW TO RECOVER ENCRYPTED FILES.TXT.' In this ransom note, the criminals will threaten the victim, claiming that they will only return the victim's files to normal by providing a decryption tool if the victim pays a large ransom amount through Bitcoin. Computer users should ignore the contents of the Scarab-Gefest Ransomware ransom note and avoid contacting the criminals or paying any ransom. Paying these ransoms or responding to the criminals only serves to put a target on the victim, opening them up to further infections and tactics.
Protecting Your Data from Threats Like the Scarab-Gefest Ransomware
The best protection against threats like the Scarab-Gefest Ransomware is to have file backups stored on the cloud or another safe place. Having backup copies ensures that you can restore any data that was compromised by the Scarab-Gefest Ransomware after an attack, removing the criminals' leverage to demand a ransom payment. Unfortunately, anti-malware software is incapable of decrypting files that are compromised using AES and RSA encryption like the one that is used in the Scarab-Gefest Ransomware attack currently. This means that taking preventive measures such as having file backups and using an anti-malware scanner is the most reliable way of protecting your computer and data from threats like the Scarab-Gefest Ransomware.
