TrueCrypter Ransomware

Posted by Max Lehmann on May 16, 2016

What is TrueCrypter Ransomware?

TrueCrypter Ransomware may well be a test project that cyber criminals ran as a preparation for a bigger hit. But this should not misguide you into believing that finding this ransomware infection on your computer is all fine. On the contrary, this infection could also be a nightmare just like any of its predecessors. Encrypting ransomware programs are probably one of the most dangerous malware infections out there today. This infection targets your most valuable files, such as documents, images, videos, and archives, and encrypts them with an algorithm that is practically impossible to decrypt without the private key. This is how cyber criminals can make a lot of easy money by selling victims this key or an application that can decrypt their files. When the encryption is done, you have to use the installed executable file to transfer your money and hope for the “good will” of these criminals to actually decrypt your files. We do not recommend that you pay the ransom fee, but this is totally your decision. What we can recommend is that you remove TrueCrypter Ransomware immediately after you realize its presence. But make up your mind before you do so because without the malicious .exe file you will not be able to pay. Let us tell you in more detail about this malware infection so that you can protect your PC next time. test test test

Where does TrueCrypter Ransomware come from?

Most ransomware infections use Trojan programs to install them onto the targeted computers. This infection is no exception either. So if you understand how a Trojan may enter your computer, you can actually prevent it from infecting your system. One of the main distribution methods to spread Trojans is via spam e-mails. These mails usually have an infectious file attached. This file can be a video or image file, or in some cases even a macro-ready document. Clicking on such a malicious attachment can drop TrueCrypter Ransomware onto your computer. Since most often you need to execute the infection yourself to start up its dirty operation, these Trojans try to pose as useful programs or software updates. Once you try to run the downloaded attachment, this ransomware gets activated.

Yet another way for Trojans to spread over the web is by exploiting social networking websites, including Facebook and Twitter. Corrupt links can be sent to someone’s wall or messenger on these popular sites. These links are usually fake videos or pictures that make you feel that “you really need to see” them. One click; that is all it takes for you to let this dangerous ransomware onto your computer. We advise you to be very careful both with your e-mails and clicking on links on your social networking sites as well. This malicious program can destroy all your most important files and you may never see them again. But one thing is certain: If you do not remove TrueCrypter Ransomware ASAP, you will not be able to use your computer.

How does TrueCrypter Ransomware work?

Once the downloaded malicious file is launched, a folder is created in %APPDATA%\Microsoft\TrueCrypter. This folder contains the files that are necessary for the operations of this ransomware. You will find, for example, “background.jpg,” which will come up as the ransom note wallpaper background, and “TrueCrypter.exe,” which is the main executable file. The encryption usually takes less than a minute and the targeted extensions include: .xlsx, .xls, .xlsm, .doc, .docx, .docm, .dot, .dotx, .dotm, .rtf, .odt, .txt, .pps, .ppt, .bmp, .gif, .jpg, .jpeg, .jpe, .jfif, .png, .tif, .tiff, .tga, .dds, .dib, .psd, .eps, .pdf, .tga, .ico, .gif, .mov, .mp4, .mp3, .avi, .css, .htm, .html, .js, .jsp, .php, .rss, .xhtml, .7z, .7zip, .rar, .rpm, .sitx, .tar.gz, .zip, .zipx, .gzip, .tar, and lot more. As you can see, you will possibly lose all your photos, videos, archives, documents, and program files. Unless, of course, you have a backup copy saved regularly onto a removable external drive. That could save you from a lot of headaches. But even if you have this copy, you should not transfer your clean files back onto your PC until you delete TrueCrypter Ransomware.

Your files are decrypted with AES-256 algorithm, while the decryption key with RSA-2048, which makes it impossible to restore your files. Once the job is done, your desktop wallpaper changes into an eye-catching red background with the ransom note on it. This note tells you to use the executable file to transfer the ransom fee, which is either 115 USD or 0.2 BTC depending on the method you choose to pay with. This ransomware actually offers you two ways to transfer the fee: the usual Bitcoins and an Amazon Gift Card. However, our malware researchers have discovered something strange about this infection, which makes us believe that this actually was “just” a test version. When you click on the Pay button even without paying any money, your files get decrypted and this infection removes itself.

However, we have also noticed that the Command and Control servers have been down for a while now. This means that unfortunately, even if you pay the fee, you will not get the decryption key. This is the main problem with most ransomware infections in fact. Because it is possible that the criminals need to shut down their servers and use new ones instead, but this usually means that the decryption keys get lost in the process. Of course, these criminals could not care less about this since their only concern is extorting money from the victims. So if you do not want to risk losing your money, we recommend that you remove TrueCrypter Ransomware right away.

How to delete TrueCrypter Ransomware

In order to put an end to this malicious attack, you can do one of two things. You can simply press Pay on the window of the executable (TrueCrypter.exe), which will delete itself. Or, you need to reboot your system and start up in Safe Mode. Then, remove the necessary files and folders. We have prepared a guide for you that you can find below this article. You may be able to avoid similar dangerous threats next time if you are more careful about your clicks, but there is a more comfortable method to protect your PC. If you use a professional anti-malware application, you can visit any websites and click any content since your system will be safeguarded with the most up-to-date malware definition, if you keep it regularly updated.