The Wormcryptor Ransomware is a file-locker that appears to have struck users in Brazil and has left them with a hard drive full of encrypted files. So far, the WormCryptor Ransomware has not been linked to any ransomware families that we know of so that there is a chance that this might be a file-encryption Trojan that was written from scratch. Regardless of its origin, it is important to mention that the WormCryptor Ransomware is fully weaponized and its attacks are guaranteed to cause a lot of damage to commonly used file formats. The encryption routine that this ransomware uses is secure, and this means that it is unlikely that we will see a free decryptor being released.

When the WormCryptor Ransomware initiates its attack, it may encrypt the contents of various documents, images, songs, videos, archives, and other common file formats immediately. All the encrypted files will be marked with the ‘.WORMCRYPT0R’ extension and the file-locker also will create the ransom note file ‘WORMCRY.txt’ on the user’s desktop. According to the contents of the ransom note, the victims will need to pay a ransom fee to restore access to their files. The operators of the WormCryptor Ransomware have not specified the amount of money they ask for and, instead, they ask the users to visit a TOR-based payment page that contains additional instructions. Last but not least, the ransom note also includes the email [email protected] that can be used to contact the perpetrators.

Unfortunately, recovering from the WormCryptor Ransomware’s attack is not an easy task because of the lack of a free decryptor. The best course of action for the victims of the WormCryptor Ransomware is to use a reputable anti-virus program that will assist them with the removal of this threat’s files. When the ransomware has been eradicated, the users can proceed to try out alternative file recovery techniques and programs.
[template:aliases][template:removal][template:technical_title][template:files][template:registry][template:additional]