Ncrypt Ransomware

Posted by Lisa Blanc on October 27, 2016

What is Ncrypt Ransomware?

Ncrypt Ransomware is highly dangerous, highly malicious software that can infect your computer secretly and demand that you pay a ransom in Bitcoins to get the unique decryption key to decrypt your files, but we suggest that you remove it instead. Nevertheless, to enter this decryption key, you will need a specific application, but this application and the decryption key are in possession of their criminal developers. We want to stress that you might not get the things you were promised, so we do not recommend that you pay the ransom. However, at present, there is no way to decrypt your files for free.

What does Ncrypt Ransomware work?

If Ncrypt Ransomware infects your computer, then it will scan it for important files that it can encrypt. Our cyber security specialists say that this ransomware should target image, video, and audio files, as well as documents that may have added-value and for which you would be willing to pay the modest ransom. Currently, researchers have yet to fully analyze this ransomware because it was released only recently, so we do not know what kind of encryption method it is designed to use. However, as mentioned, a decryption tool has yet to be created, so it is likely that its encryption method is quite strong.

Ncrypt Ransomware should encrypt files in nearly all locations on your PC and you can distinguish an encrypted file from an unencrypted file by trying to open it, obviously, but you can take note of its file extension as well. Researchers say that when this ransomware encrypts files, it appends them with the .NCRYPT file extension. Furthermore, during the encryption, it will drop an HTML file named _FILE_RETRIEVAL_INSTRUCTIONS.html to each folder where files were encrypted and possibly on the desktop as well.

_FILE_RETRIEVAL_INSTRUCTIONS.html serves as the ransom note, and it says that you have to pay 0.2 BTC (approximately, $120.00 USD) for the decryption key and application. This note also provides the Bitcoins wallet address to which you are expected to transfer to funds. Once you have made the payment, you are asked to send an email to rw1contact@onionmail.info with your unique ID number I the subject line and the Bitcoin transaction ID in the body. And then, you should wait for the cyber criminal to respond to you and give to you the decryption key and software. The ransom note also says that you have to pay the random within a given timeframe or you will not be able to decrypt your files.

Where does Ncrypt Ransomware come from?

Since this ransomware has been released only recently, our malware researchers have yet to find how it is distributed. Some researchers suggest that it is distributed using malicious emails that pose a invoices, tax return forms, receipts, and so on and feature an attached file that automatically drops this ransomware’s executable on your computer when opened. The attached file may be a JavaScript file or a self-extracting file archive that secretly download the executable in the former and extract it in the latter case. Nevertheless, there is little to no concrete information about how this ransomware is distributed, but regardless of its distribution, a powerful anti-malware program can stop it dead in its tracks.

How to remove Ncrypt Ransomware

Ncrypt Ransomware is a typical ransomware whose objective is to encrypt your personal files and then demand that you pay a ransom to get the decryption tool and key to decrypt them. However, you should refrain from paying the ransom because there is no guarantee that you will get what you have paid for. To remove this ransomware, we recommend that you use SpyHunter’s free scan feature and go to the location shown in the scan results and delete the executable manually.