Obliterating Cassetto Ransomware (Crypto-Malware/Ransomware)

What is Cassetto ransomware? And how does it execute its attack?

Cassetto ransomware is yet another crypto-virus designed to encrypt data and leave them inaccessible to victims. This crypto-malware was discovered recently and does not appear to be related to any ransomware group.

It begins its attack by dropping a malicious payload in the system which is used to connect the computer to a remote server. From there, it downloads more malicious files. It then employs a data gathering module used to collect information about the user and the computer. The data collected, along with the malicious files that were downloaded earlier will be used for stealth protection. Stealth protection protects the crypto-malware from being detected by any security programs. After that, modifications in the system are also carried out particularly in the Windows Registry where it modifies some registry entries and keys so that it can run automatically during startup.

Once all the modifications are completed, it starts to scan the entire drive of the computer looking for files with specific formats like the database, documents, images, videos, audio files, PDF files and many more. It applies the AES or RSA cryptography in locking targeted files. And after the encryption, it appends the .cassetto extension to every encrypted file. It then drops a file named “IMPORTANT ABOUT DECRYPT.txt” which contains the following ransom note:

“WARNING!! YOU ARE SO F*UCKED!!!

Your Files Has Encrypted

What happened to your files?

All of your files were protected by a strong encryption

There is no way to decrypt your files without the key.

If your files not important for you just reinstall your system.

If your files are important just email us to discuss the price and how to decrypt your files.

You can email us to [email protected]

We accept just BITCOIN if you don´t know what it is just google it.

We will give instructions where and how you buy bitcoin in your country.

Price depends on how important your files and network is.

It could be 0.5 bitcoin to 25 bitcoin.

You can send us an encrypted file for decryption.

Feel free to email us with your country, computer name, and username of the infected system.”

If you are one of the unlucky users who got infected with Cassetto ransomware, paying the ransom demanded by the crooks is not recommended. These crooks might only trick you into paying the ransom and won’t actually give you to decryption software. The best way to deal with such threats is by obliterating it from your computer right away and then try other alternative ways to restore the affected files.

How is the malicious payload of Cassetto ransomware disseminated?

The malicious payload of Cassetto ransomware is most likely disseminated via spam emails. Crooks usually attach malicious files into emails and use spam bots in disseminating them which is why you need to check every email you receive before you download any kind of attachment or click any links in the email.

Use the removal guide given below in obliterating Cassetto ransomware.

Step 1: Tap Ctrl + Shift + Esc keys to launch the Task Manager.

Step 2: Go to the Processes and Applications tab and look for the malicious processes of Cassetto ransomware then right click on them and select End Process or End Task.

Step 3: Close the Task Manager and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.

Step 4: Look for dubious programs that might be related to Cassetto ransomware and then Uninstall it/them.

Step 5: Tap Win + E to launch File Explorer.

Step 6: After opening File Explorer, navigate to the following directories below and look for Cassetto ransomware’s malicious components such as Cassetto.exe or [random].exe as well as a text file named IMPORTANT ABOUT DECRYPT.txt which contains the ransom note and other suspicious-looking files and then remove them all.

§ %TEMP%

§ %APPDATA%

§ %DESKTOP%

§ %USERPROFILE%\Downloads

§ C:\ProgramData\local\

Step 7: Close the File Explorer.

Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use [product-name], this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.

Step 8: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 9: Navigate to the listed paths below and look for the registry keys and sub-keys created by Cassetto ransomware.

§ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

§ HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

§ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

§ HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

§ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background

§ HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization

§ HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveTimeOut

§ HKEY_CURRENT_USER\Control Panel\Desktop

Step 10: Next, delete the registry keys and sub-keys created by Cassetto ransomware.

Step 11: Close the Registry Editor.

Step 12: Finally, empty the contents of your Recycle Bin.

Try to recover your encrypted files using the Volume Shadow copies

Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if Cassetto ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.

To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

Once you’re done executing the steps given above, you need to continue the removal process of Cassetto ransomware using a reliable program like [product-name]. How? Follow the advanced removal steps below.

Perform a full system scan using [product-code]. To do so, follow these steps:

1. Turn on your computer. If it’s already on, you have to reboot it.

2. After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.