Princess Evolution Ransomware

Posted by Sarah Stewart on September 24, 2018

What is Princess Evolution Ransomware?

Princess Evolution Ransomware is a new threat promoted on underground forums as RaaS (Ransomware-as-a-Service). In other words, anyone interested can join cyber criminals and start distributing this malicious application in exchange for 60% of all the payments received. This may sound like a tempting offer, so we bet the ransomware developer will find some “business partners”. As a consequence, it has a potential of becoming a prevalent threat. Anyone can encounter ransomware no matter where they live. Of course, malware usually affects those computers that are unprotected, i.e. with no security software installed on them. We hope that you will not fall victim to Princess Evolution Ransomware, but if it is too late for prevention, i.e. the ransomware infection has already locked almost all files on your computer, its complete removal is what you should do in the first place. Once the infection is removed from the system fully, you could think about the decryption of files. Sending money to malicious software developers is not what we have in mind here. test test test

What does Princess Evolution Ransomware do?

The ransomware infection checks whether the system has not been encrypted before once executed. Specifically speaking, it searches for a mutual exclusion object (mutex) named hoJUpcvgHA. Also, it checks the %APPDATA% folder for MeGEZan.VDE. If either of these files is detected on the system, the ransomware infection quits. Since it stops working completely, files are not encrypted on the affected computer again. If you are not that lucky, i.e. your personal files have been encrypted and you can no longer access them, you must delete Princess Evolution Ransomware right away. It is a must to get rid of it – it may lock more files on the affected computer if not removed. You do not need to be an expert to find out which files have been locked on your system because the ransomware infection appends random extensions, consisting of 4-6 characters, to all affected files. On top of that, you will simply soon realize that encrypted files are the ones that cannot be opened. They are all locked using XOR and AES-128 algorithms. After successfully encrypting files, Princess Evolution Ransomware drops three files in .html, .txt, and .url formats. If you open the .txt file, you will find a short message there. It explains why users cannot open their files and, on top of that, presents a possible solution to the problem. Ransomware victims are told to download and install the TOR Browser first and then open the provided .onion link. We are 99% sure you will find instructions on how to make a payment to cyber criminals on this page.The decryptor cyber criminals have is probably not cheap, but it is not the only reason we cannot call transferring money to crooks a smart move. We consider this nonsense because we know well that cyber criminals may not send the decryptor to you at all.

Where does Princess Evolution Ransomware come from?

Princess Evolution Ransomware also encrypts files, drops a ransom note, and demands money, but there is one thing that distinguishes it from other ransomware infections. Specialists have observed that it is distributed via the RIG Exploit Kit available on shady websites. Additionally, you might download it from the web yourself, it might be dropped on your PC after hacking the RDP connection you use, and, finally, you might find your files locked if you ever open a malicious attachment distributing it. It is not a piece of cake to prevent serious malware from entering the system, but it does not mean that threats cannot be stopped. You will not find a single untrustworthy application installed on your PC if you keep an antimalware tool enabled. This is the easiest way to protect the system against malware.

How do I delete Princess Evolution Ransomware?

You cannot keep any program that turns out to be a malicious application installed on your computer, especially if it is ransomware or another harmful infection, because a number of problems will arise in no time. As for the Princess Evolution Ransomware removal, you need to erase the malicious file you have launched, i.e. the launcher of the ransomware infection, and files this threat has dropped on your computer. You will find them listed below in our manual removal guide.

NB You can delete hoJUpcvgHA and %APPDATA%\MeGEZan.VDE as well, but this is not what specialists recommend that you do. If you keep those files, Princess Evolution Ransomware will not lock files on your PC once again in case you encounter it in the future.

Princess Evolution Ransomware removal guide

Check your Desktop, Downloads, or another folder you keep your downloads in.
Delete the malicious file launched.
Remove all files dropped on your computer: