Terminating Stinger Ransomware (Crypto-Malware/Ransomware)

What is Stinger ransomware? And how does it implement its attack?

Stinger ransomware is a newly discovered ransomware threat seeking to encrypt files on targeted PCs. This file-encrypting threat utilizes the AES encryption algorithm in locking its targeted files. It was spotted in the middle of March this year by a group of security researchers. According to these researchers, it mainly targets English, German and French-speaking users. Nevertheless, it doesn’t mean it can’t affect other users all over the globe. Researchers also noted that this ransomware contains the following parameters:
SHA-256:ef294e69cda98f1a76367d07f009e340176f523fe2fb7495f6161046d4f0944f
Name:874632c09503322f62525b0735e59e84.virus
Size:39.5 KB
The moment it manages to infect a system, it will immediately create and download several malicious files to help it implement its attack. It also modifies the Windows Registry to achieve persistence. After that, it will encrypt files with the following extensions using the AES cipher.
PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG .CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG
Each of the encrypted file will have the .Stinger extension, signifying the attack of Stinger ransomware. Victims are then informed about the attack using a ransom note contained in a file named “About .Stinger unlocking instructions.txt” that states:
“Hello, friend, Please read the following
Your file has been locked, please do not close the system, or modify the extension name

Ó§Ñ§ê §æ§Ñ§Û§Ý §Ù§Ñ§Ò§Ý§à§Ü§Ú§â§à§Ó§Ñ§ß, §á§à§Ø§Ñ§Ý§å§Û§ã§ä§Ñ, §ß§Ö §Ù§Ñ§Ü§â§í§ä§î §ã§Ú§ã§ä§Ö§Þ§í §Ú§Ý§Ú §Ú§Ù§Þ§Ö§ß§Ú§ä§î §â§Ñ§ã§ê§Ú§â§Ö§ß§Ú§Ö §æ§Ñ§Û§Ý§Ñ.

Votre dossier est verrouill¨¦, veuillez ne pas le syst¨¨me de fermeture ou de modifier des extensions.
¥Õ¥¡¥¤¥ë¤¬¥í¥Ã¥¯¤µ¤ì¤Æ¤¤¤ë¤Î¤Ç¡¢¥·¥¹¥Æ¥à¤òé]æi¤·¤¿¤ê¡¢Ãû¤òÐÞÕý¤·¤¿¤ê¤·¤Ê¤¤¤Ç¤¯¤À¤µ¤¤¡£
Die datei IST gesperrt, bitte nicht verschließen Oder änderung der verlängerung.
Please E-Mail me, unlock the cost USD 100.00.

±§à§Ø§Ñ§Ý§å§Û§ã§ä§Ñ, §ã§Ó§ñ§Ø§Ú§ä§Ö§ã§î §ã §ï§Ý§Ö§Ü§ä§â§à§ß§ß§à§Û §á§à§é§ä§í, §â§Ñ§Ù§Ò§Ý§à§Ü§Ú§â§à§Ó§Ñ§ä§î §â§Ñ§ã§ç§à§Õ§í USD 100.00.

SID£º[EA2410]
E-mail:[email protected]”
As you can tell, the ransom note of Stinger ransomware does not provide much information about itself and victims are urged instead to contact the given email address. If you are one of the unfortunate victims of Stinger ransomware, there is no need for you to contact the crooks behind this crypto-malware because one thing’s for sure – the cyber crooks will demand a huge amount of ransom which is totally not worth it as it does not really guarantee that you’ll get your files back. So instead of wasting your money and time with these criminals, it’s better if you prioritize the removal of the threat and then try other alternative ways to recover your encrypted files.
How does Stinger ransomware proliferate?
At the time of writing it is still unclear how specifically Stinger ransomware proliferates but it most likely uses the most common method used by most ransomware threats – spam emails. So you need to be cautious in opening any suspicious-looking emails and the instant you spot one, delete it right away.
Terminate Stinger ransomware by following these instructions:
Step 1: Tap Ctrl + Shift + Esc keys to launch the Task Manager.
Step 2: Go to Processes and look for the malicious process of Stinger ransomware then right click on it and select End Process or End Task.

Step 3: Close the Task Manager and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.
Step 4: Look for dubious programs that might be related to Stinger ransomware and then Uninstall it/them.

Step 5: Tap Win + E to launch File Explorer.
Step 6: After opening File Explorer, navigate to the following directories below and look for Stinger ransomware’s malicious components such as About .Stinger unlocking instructions.txt and remove them all.

%TEMP%
%APPDATA%
%DESKTOP%
%USERPROFILE%\Downloads
C:\ProgramData\local\

Step 7: Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use Advanced System Repair Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 8: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 9: Navigate to the listed paths below and look for the registry keys and sub-keys created by Stinger ransomware.

HKEY_CURRENT_USER\Control Panel\Desktop\
HKEY_USERS\.DEFAULT\Control Panel\Desktop\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Step 10: Delete the registry keys and sub-keys created by Stinger ransomware.
Step 11: Close the Registry Editor.
Step 12: Empty your Recycle Bin.
Restore the previous state of your files using the Shadow Volume copies
Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if Stinger ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

Making sure that Stinger ransomware is completely terminated from your system is very essential. That’s why you need to follow the advanced steps below to ensure the removal of this file-encrypting malware.
Perform a full system scan using Advanced System Repair Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in the URL address, http://advancedsystemrepair.com/ASR_Installation.exein the Run dialog box and then tap Enter or click OK.
After that, it will download Advanced System Repair Pro. Wait for the download to finish and then open the launcher to install the program.
Once the installation process is completed, run Advanced System Repair Pro to perform a full system scan.