[template:parasites-id:LightningCrypt Ransomware]
The LightningCrypt Ransomware is a file-encryption Trojan whose file-locking mechanism is yet to be cracked. This means that users whose data is taken hostage by the LightningCrypt Ransomware, will not have the opportunity to take advantage of a free decryption utility to recover their files. Despite the lack of a free recovery option, we’d like to remind our readers that the people behind the LightningCrypt Ransomware are not the ones they need to turn to for help. When the LightningCrypt Ransomware attacks a computer, it will seek to lock documents, photos, archives, and other commonly used file extensions so that their contents will be inaccessible. Every locked file will have its name altered by adding the ‘.LIGHTNING’ extension, therefore making it easy for victims to identify the files they lost during the attack.
After the LightningCrypt Ransomware finishes encrypting the data found on the local hard drive, it will leave two files for the user to find – ‘LightningCrypt_Recover_Instructions.txt’ and ‘LIGHTNINGCRYPT_UNIQUEID.txt.’ The first one contains the ransom note, while the second one includes the victim’s unique ID, which must be included when sending the payment to the attackers. However, we advise users not to send any money to the perpetrators, since it is very likely that they’ll end up taking the money without providing the promised decryption tool. The ransom the authors of the LightningCrypt Ransomware demand is 0.17 BTC, and the money must be sent to a wallet address included in the ransom note. The ransom message does not include e-mail addresses or other contact details that may allow victims to talk to the kidnappers of their files.
‘@@LIGHTNINGDECRYPT@@
YOU BECAME A VICTIM OF THE the LightningCrypt Ransomware!
ALL YOUR FILES HAVE BEEN ENCRYPTED
FOR EACH TRY TO FO ANYTHING I WILL DELETE FILES
PAY 0.17 BITCOINS TO THIS ADDRESS: 1LSgvYFY7SDNje2Mhsm51FxhqPsbvXB
YOU CAN BUY BITCOINS ON “BLOCKCHAIN.INFO”
SEND YOUR UNIQUE ID IN THE DESCRIPTION OF THE BITCOIN PAYMENT
YOU CAN FIND THEM IN YOUR DESKTOP IN “LIGHTNINGCRYPT_UNIQUEID.TXT”
AFTER THE PAYMENT YOUR FILES WILL BE DECRYPTED!
HAVE FUN
PAY 0.17 Bitcoins to: [REDACTED]’
Apart from the two text files, the LightningCrypt Ransomware will also display a program window that contains a copy of the ransom note. The window is titled ‘@@LIGHTNINGCRYPT@@@’ and it does not include any additional information or decryption instructions. If your data was locked by the LightningCrypt Ransomware, then the best solution, for now, is to eliminate the harmful program with the assistance of a trustworthy anti-malware program. When this step is complete, it is a good idea to try and use some file recovery software to restore some of the encrypted files partially.
[template:aliases][template:removal][template:technical_title][template:files][template:registry][template:additional]
