What is .ecc ransomware? And how does it carry out its attack?
.ecc ransomware is a new crypto-malware discovered recently and appears to be a new and improved variant of the Cryptolocker ransomware. It had been named as “ecc” ransomware as it appends the .ecc extension to every file it encrypts. This new variant is also known as “VV 0” ransomware and aims to encrypt files on a targeted device to extort money from victims.
Once it carries out its attack, .ecc ransomware uses privilege escalation so it can perform a set of malicious activities on the targeted computer. But before it drops its malicious payload, it first checks if it has been run in a virtual environment – if so, it quickly shuts down the computer and won’t drop the malicious payload. But if it turns out that it hasn’t been run yet, it will proceed in placing the malicious payload in the system and will drop them in some Windows directories. After that, it will modify the Windows Registry in order to create value strings with data that will point out to the location of the crypto-malware. The Registry sub-keys where the string is created may be both the Run and RunOnce keys so .ecc ransomware can run whenever a victim starts their Windows computer. Shortly after these modifications, .ecc ransomware will start to encrypt its targeted files that are mostly generated by users like a database, documents, images, audio file, videos, and so on. It uses the RSA 2048 cipher in locking its targeted files. Following data encryption, the .ecc extension is added on each one of the affected files. A detailed ransom note will be displayed in a program window that contains this message:
“Your personal files are encrypted!
Your files have been safely encrypted on this PC: photos, videos, documents, etc.
Click “Show encrypted files” Button to view a complete list of encrypted files,
and you can personally verify this.
Encryption was produced using a unique public key RSA-2048 generated
for this computer. To decrypt files you need to obtain the private key.
The only copy of the private key, which will allow you to decrypt your files,
is located on a secret server on the Internet; the server will eliminate the key
Your private key will be after a time period specified in this window.
Once this has been done, nobody will ever be able to restore files…
In order to decrypt the files press button to open your personal page
File decryption site land follow the instruction.
in case of “File decryption button” malfunction use one of our gates:
Time left:
Use your Bitcoin address to enter the site:
Click to copy the address to clipboard I
if both button and reserve gate not opening, please follow the steps:
You must install this browser www.torproject.orgzprojectsltorbrowser.html.en
After installation, run the browser and enter address 3lorwjihmkgibht25.onion
Follow the instruction on the website. We remind you that the sooner you do so,
the more chances are left to recover the files.
Any attempt to remove or corrupt this software will result in an immediate elimination of the private key by the server.”
How is the malicious payload of .ecc ransomware disseminated?
The malicious payload of .ecc ransomware may be disseminated via spam emails. These malware-laden emails usually imitate FedEx, DHL, eBay and other well-known companies to deceive users into clicking a button or opening email attachments used to launch .ecc ransomware into the system.
Use the removal instructions prepared below to eliminate .ecc ransomware from your computer.
Step 1: Tap the Ctrl + Alt + Delete keys to open a menu and then expand the Shutdown options which is right next to the power button.
Step 2: After that, tap and hold the Shift key and then click on Restart.
Step 3: And in the Troubleshoot menu that opens, click on the Advanced options and then go to the Startup settings.
Step 4: Click on Restart and tap F4 to select Safe Mode or tap F5 to select Safe Mode with Networking.
Step 5: After your PC has successfully rebooted, tap Ctrl + Shift + Esc to open the Task Manager.
Step 6: Go to the Processes tab and look for suspicious-looking processes that take up most of your CPU power then end all of its processes.
Step 7: Exit the Task Manager and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.
Step 8: Look for a suspicious-looking program you don’t remember installing as it could be related to .ecc ransomware. Once you find any questionable program, do not hesitate to uninstall it.
Step 9: Close Control Panel and tap Win + E keys to open File Explorer.
Step 10: Navigate to the following locations and look for the installer of .ecc ransomware as well as other related files and delete them all.
- %TEMP%
- %APPDATA%
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
- %USERPROFILE%\Downloads
- %USERPROFILE%\Desktop
Step 11: Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use system tool known as [product-name]. This program is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 12: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.
Step 13: Navigate to the listed paths below and look for the registry keys and sub-keys created by .ecc ransomware.
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Step 14: Delete the registry keys and sub-keys created by .ecc ransomware.
Step 15: Close the Registry Editor and empty your Recycle Bin.
Try to recover your encrypted files using their Volume Shadow copies
Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if .ecc ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.
After you’ve covered the steps provided above, you need to continue the removal process of .ecc ransomware using a reliable program like [product-name]. How? Follow the advanced removal steps below.
Perform a full system scan using [product-code]. To do so, follow these steps:
- Turn on your computer. If it’s already on, you have to reboot
- After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.
- To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
- Windows will now load the SafeMode with Networking.
- Press and hold both R key and Windows key.
- If done correctly, the Windows Run Box will show up.
- Type in the URL address, [product-url] in the Run dialog box and then tap Enter or click OK.
- After that, it will download the program. Wait for the download to finish and then open the launcher to install the program.
- Once the installation process is completed, run [product-code] to perform a full system scan.
- After the scan is completed click the “Fix, Clean & Optimize Now”button.
