Ahnlab Magniber Decrypt V4
Ahnlab Magniber Decrypt V4.1

AhnLab Recognized as 2020 South Korea Endpoint Security Vendor of the Year for Two Consecutive Years: 2020-12-17: 327: 227: AhnLab V3 Nominated as Top Product by AV-TEST on October 2020 Evaluation: 2020-12-07: 64: 226: AhnLab Warns of Phishing Website Disguised as Popular Out-of-Stock Items: 2020-11-18: 30: 225. Expand Your Business through AhnLab Partner Program. Security Center. Security Insight. Security Risk Level. Find the latest threat intelligences direct from AhnLab’s security experts. AhnLab Solutions Portfolio.

My Decryptor ransomware removal instructions

Clone via HTTPS Clone with Git or checkout with SVN using the repository’s web address. At the end of March 2018, security researchers from AhnLab released multiple decryptors for different types of Magniber virus. The recovery tool functions based on an encryption bug that was left out by hackers. Below you can see the table showing which versions of Magniber. DECRYPT ME; Search for: The Week in Ransomware – January 1st 2021. DID YOU KNOW: 1 in 13 web requests lead to malware. @BleepinComputer, @AhnLabSecuInfo, @chum1ng0, @siriurz, @Kangxiaopao, @Jirehlov, @fbgwls245, @MShahpasandi,.

What is My Decryptor?

My Decryptor (also known as Magniber) is a ransomware-type virus discovered by malware security researcher, Michael Gillespie. Once infiltrated, My Decryptor encrypts stored files and appends filenames with an extension comprising seven random characters. For instance, 'sample.jpg' might be renamed to a filename such as 'sample.jpg.gkelhoh'. At this moment cyber criminals are using '.ypkwwmd', '.ndpyhss', '.wmfxdqz', '.axlgsbrms', '.nhsajfee', '.mqpdbn', '.damdzv', '.qmdjtc', '.mftzmxqo', '.demffue', '.dxjay', '.fbuvkngy', '.xhspythxn', '.dlenggrl', '.skvtb', “.vbdrj”, “.fprgbk”, '.ihsdj', '.mlwzuufcg' or '.kgpvwnr' extensions for encrypted files. After successfully encrypting files, My Decryptor creates a text file ('_HOW_TO_DECRYPT_MY_FILES_[random_characters]_.txt', 'READ_ME_FOR_DECRYPT_[victim’s id].txt') or READ_ME.txt, placing it on the desktop.

The text file contains a message stating that files are encrypted and can only be restored using a unique decryption tool together with a unique (private) key. Unfortunately, this information is accurate. It is currently unknown which cryptography My Decryptor ransomware uses, however, as the message mentions a 'private' key, it is safe to assume that the encryption is asymmetric. Therefore, two keys (public [encryption] and private [decryption]) are generated. Cyber criminals store the private key on a remote server. Decryption without this key is impossible. Victims are encouraged to pay a ransom in exchange for the key and decryption tool - they are instructed to visit My Decryptor's website to receive these assets. The cost of decryption is .2 Bitcoin (currently equivalent to ~$1145). It is also stated that the ransom must be paid within five days, after which the cost will double. Be aware that cyber criminals cannot be trusted. Research shows that these people often ignore victims, once payments are submitted. Therefore, paying does not guarantee decryption of your files and there is a high probability that you will be scammed. As well as losing your money, you will support cyber criminals' malicious businesses. Therefore, we strongly advise you to ignore all requests to pay any ransoms. Unfortunately, there are currently no tools capable of restoring files encrypted by My Decryptor. The only solution is to restore your files/system from a backup.

Screenshot of a message encouraging users to pay a ransom to decrypt their compromised data:

My Decryptor shares many similarities with dozens of other ransomware-type viruses. The list of examples includes (but is not limited to) Anubi, BugWare, Asasin, and SyncCrypt. These viruses are developed by different criminals, however, their behavior is identical - all encrypt files and makes ransom demands. The only major differences are size of ransom and type of encryption algorithm used. Research shows that, unfortunately, most of these viruses employ algorithms (foe example, AES, RSA, etc.) that generate unique decryption keys. Therefore, unless the malware contains bugs/flaws or is not fully developed, file decryption manually (without involvement of developers - contacting these people is not recommended) is impossible. For these reasons, ransomware-type viruses such as My Decryptor present a strong case for maintaining regular data backups.

How did ransomware infect my computer?

Ransomware-type viruses are proliferated in various ways, however, the most common are: spam emails, third party software download sources, fake software update tools, and trojans. Spam emails often contain malicious attachments (such as JavaScript files, MS Office documents, etc.) that, once opened, download and install malware. Unofficial software distribution sources (peer-to-peer [P2P] networks, free file hosting websites, freeware download websites, etc.) often present malicious executables as legitimate software, thereby tricking users into downloading and running malware . Fake software updaters exploit outdated software bugs/flaws to infect the system. Trojans are the simplest ones - they merely open 'gates' for other malware to infiltrate the system.

Threat Summary:
Name	My Decryptor virus
Threat Type	Ransomware, Crypto Virus, Files locker
Encrypted Files Extension	7 random characters.
Ransom Demanding Message	_HOW_TO_DECRYPT_MY_FILES_[random_characters]_.txt, READ_ME_FOR_DECRYPT_[victim’s id].txt, READ_ME.txt, Tor website
Ransom Amount	0.2 Bitcoin
Cyber Criminal Contact	Developers provide support via Tor website.
Detection Names	Ad-Aware (Gen:Variant.Razy.518505), BitDefender (Gen:Variant.Razy.518505), Emsisoft (Gen:Variant.Razy.518505 (B)), ESET-NOD32 (A Variant Of Win32/GenKryptik.CUTS), Full List Of Detections (VirusTotal)
Symptoms	Cannot open files stored on your computer, previously functional files now have a different extension (for example, my.docx.locked). A ransom demand message is displayed on your desktop. Cyber criminals demand payment of a ransom (usually in bitcoins) to unlock your files.
Distribution methods	Infected email attachments (macros), torrent websites, malicious ads.
Damage	All files are encrypted and cannot be opened without paying a ransom. Additional password-stealing trojans and malware infections can be installed together with a ransomware infection.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Malwarebytes. ▼ Download Malwarebytes To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.

How to protect yourself from ransomware infections?

To prevent ransomware infections, be very cautious when browsing the Internet. Never open files attached to emails sent from suspicious addresses. These emails should be deleted without reading. Furthermore, download your software from official sources only and, preferably, using a direct download link (third party download/installation tools often include malicious programs). Keep installed programs updated, however, note that criminals proliferate malware via fake updaters. Therefore, updating software via third party tools is very risky. Using a legitimate anti-virus/anti-spyware suite is essential. The main reasons for computer infections are poor knowledge and careless behavior - the key to computer safety is caution.

Text presented within My Decryptor text file:

ALL Y0UR D0CUMENTS, PHOTOS, DATABASES AND OTHER IMP0RTANT FILES HAVE BEEN ENCRYPTED!
Your files ar

Ahnlab Magniber Decrypt