CryptoJoker Ransomware

What is CryptoJoker?

CryptoJoker is a ransomware-type virus that encrypts various files (for example, .txt, .doc, .docx, .ppt, etc.) stored on victims' computers.

All files are encrypted using AES-256 encryption, and once successfully encrypted, victims are presented with a message stating that they are required to pay a ransom in bitcoins (otherwise the files will remain permanently decrypted). CryptoJoker is distributed as a .PDF file and, therefore, is often proliferated as an email attachment.

Once the CryptoJoker's installer (the .PDF file) is executed, a number of malicious files are downloaded/generated within the %AppData% or %Temp% folders. Be aware that CryptoJoker adds a ".crjoker" extension to each encrypted file.

Updated variants of this ransomware use ".cryptoNar", ".partially.cryptolocker", ".partially.nocry", ".devos", and ".devoscpu" extensions for encrypted files.

The displayed lockscreen contains all information regarding the encryption and states that users must pay a ransom within the given time frame, otherwise the private key (which is used to decrypt files) will be deleted and it will become impossible to recover the files affected by CryptoJoker.

The message contains step-by-step payment instructions delivered in English and Russian. At this time, there are no tools capable of returning users' data to the previous state. Therefore, the best way to solve this problem is to restore your system from a backup.

Screenshot of a message encouraging users to contact the developers of CryptoJoker ransomware to decrypt their compromised data:

There are many ransomware-type viruses with similar characteristics including CryptoJoker. XRTN, CryptoWall, Chimera, and TeslaCrypt - these just some examples from a long list. All of these viruses have virtually identical behavior - the only difference is the size of the ransom and the given time frame.

Computer infections such as these are one of the main reasons why you should maintain regular backups of your stored data. By paying the ransom, you merely support the malicious businesses of cyber criminals and you can never be sure that your files will be decrypted.

For this reason, never attempt to pay the ransom or contact the developers. Ransomware viruses are often distributed using infectious email attachments, P2P networks, and fake software updates. Therefore, you should use a legitimate anti-spyware or anti-virus suite and keep all installed software up-to-date.

Update 29 August 2018 - Security researcher Michael Gillespie released a free decrypter for this ransomware - victims can use this toll to decrypt files encrypted by this ransomware completely free. Download it HERE.

Current anti-virus detection for CryptoJoker in VirusTotal.

CryptoJoker demanding ransom payment to decrypt files:

========================================================================
ENGLISH:
Your personal files were encrypted using RSA key cryptographically!
It decrypts files can be knowing a unique, private RSA key length of 2048 bits, which is only for us.
Write to us at mail: [email protected] Spare mails: [email protected] or [email protected]
Instructions for payment will be sent in the opposite letter.
After payment we will send your key and decoder.
And remember, you only have 72 hours to make a payment, then the price will rise to decipher.
Attempts to decipher on their own will not lead to anything other than irretrievable loss of information.
Your unique key that is required to send to the specified email:
Good luck.
RUSSIAN:
Ваши личные файлы были зашифрованы при помощи криптостойкого RSA ключа!
Расшифровать файлы можно зная уникальный, закрытый RSA ключ длиной 2048 бит, который есть только у нас.
Напишите нам на мейл: [email protected] Запасные мейлы: [email protected] или [email protected]
Инструкция для оплаты будут высланы в обратном письме.
После оплаты мы вышлем ваш ключ и дешифратор.
И помните, у вас есть только 72 часа, чтобы произвести оплату, потом цена на расшифровку поднимется.
Попытки расшифровать самостоятельно не приведут ни к чему, кроме безвозвратной потери информации.
Ваш уникальный ключ, который обязательно вышлите на указанный email:
Удачи.
========================================================================

Some file formats targeted by CryptoJoker ransomware:

.txt, , .doc, .docx, .xls, .xlsx, .ppt, .pptx, .odt, .jpg, .png, .csv, .sql, .mdb, .sln, .php, .asp, .aspx, .html, .xml, .psd, .java, .jpeg, .pptm, .pptx, .xlsb, .xlsm, .db, .docm, .sql, .pdf

CryptoJoker files in %Temp% and %AppData% folders:

%AppData%\dbddbccdf.exe %AppData%\README!!!.txt22 %Temp%\crjoker.html %Temp%\drvpci.exe %Temp%\GetYouFiles.txt %Temp%\imgdesktop.exe %Temp%\new.bat %Temp%\README!!!.txt %Temp%\sdajfhdfkj %Temp%\windefrag.exe %Temp%\windrv.exe %Temp%\winpnp.exe

CryptoJoker registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\winpnp %Temp%\winpnp.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\drvpci %Temp%\drvpci.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\windefrag %Temp%\windefrag.exe

Update 22 November, 2017 - Cyber criminals have released yet another ransomware called "CryptoJoker". This variant uses ".partially.cryptojoker" extension for encrypted files and stores it's ransom demanding message in "CryptoJoker Recovery Information.txt" file.

Screenshot of CryptoJoker Recovery Information.txt file:

Ransom demanding message presented in this file:

Hello, my name is CryptoJoker !!

My name is CryptoJoker. I have encrypted all your precious files including images,
videos, songs, text files, word files and e.t.c  So long story short, you are screwed ... but you are lucky
in a way. Why is that ?? I am ransomware that leave you an unlimited amount of time to gather the money
to pay me. I am not gonna go somewhere, neither do your encrypted files.

FAQ:

1. Can i get my precious files back ??
Answer: Ofcourse you can. There
is just a minor detail. You have to pay to get them back.
2. Ok, how i am gonna get them back ?
Answer: You have to pay 100€
in bitcoin.
3. There isn't any other way to get back my files ?
Answer: Nahhh.
4. Ok, what i have to do then ?
Answer: Simply,
you will have to pay 100€ to this bitcoin address: 1yh3eJjuXwqqXgpu8stnojm148b8d6NFQ . When time comes to send me the money,
make sure to include your e-mail and your personal ID(you can see it bellow) in the extra information box (it may apper also
as 'Extra Note' or 'optional message') in order to get your personal decryption key. It may take up to 6-8 hours to take your
personal decryption key.
5. What the heck bitcoin is ?
Answer: Bitcoin is a cryptocurrency and a digital payment system.
You can see more information here: https://en.wikipedia.org/wiki/Bitcoin . I recommend to use 'Coinbase' or 'Bitcoin Wallet'
as a bitcoin wallet, if you are new to the bitcoin-wallet. Ofcourse you can pay me from whatever bitcoin wallet you want,
it deosn't really matter.
6. Is there any chance to unclock my files for free ?
Answer: Not really. After 1-2 or max 3 years
there is propably gonna be released a free decryptor. So if you want to wait ... it's fine. As i said, i am not gonna go
somewhere.
7. What i have to do after getting my decryption key ?
Answer: Simple. Just press the decryption button bellow.
Enter your decryption key you received, and wait until the decryption process is done.
Your personal ID: -

Files encrypted by this variant of CryptoJoker ransomware (".partially.cryptojoker" extension):

CryptoJoker ransomware removal:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is CryptoJoker?
• STEP 1. CryptoJoker virus removal using safe mode with networking.
• STEP 2. CryptoJoker ransomware removal using System Restore.

Step 1

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu".

Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Step 2

Log in to the account infected with the CryptoJoker virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.

If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.

Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":

1. During your computer start process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.

3. Next, type this line: rstrui.exe and press ENTER.

4. In the opened window, click "Next".

5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the CryptoJoker ransomware virus infiltrating your PC).

6. In the opened window, click "Yes".

7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining CryptoJoker ransomware files.

To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of CryptoJoker are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.

To restore a file, right-click on it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.

If you cannot start your computer in Safe Mode with Networking (or with Command Prompt), boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.

To regain control of the files encrypted by CryptoJoker, you can also try using a program called Shadow Explorer. More information on how to use this program is available here.

 To protect your computer from file encrypting ransomware such as this, use reputable antivirus and anti-spyware programs. As an extra protection method, you can use programs called HitmanPro.Alert and Malwarebytes Anti-Ransomware, which artificially implant group policy objects into the registry to block rogue programs such as CryptoJoker ransomware.)

HitmanPro.Alert CryptoGuard - detects encryption of files and neutralises these attempts without need for user intervention:

Malwarebytes Anti-Ransomware Beta uses advanced proactive technology that monitors ransomware activity and terminates it immediately - before reaching users' files:

• The best way to avoid damage from ransomware infections is to maintain regular up-to-date backups. More information on online backup solutions and data recovery software Here.

Other tools known to remove CryptoJoker ransomware:

• Malwarebytes Anti-Malware

▼ Show Discussion