Ncrypt Ransomware

We have recently analyzed a new ransomware-type application known as Ncrypt Ransomware. Evidently, this application falls into the category of ransomware because it is designed to encrypt almost all of the files on your PC and offer you to purchase the decryption key for a modest sum of 120 USD. However, you should consider removing it because it was created by cyber criminals, so do not expect them to keep their end of the bargain. Unfortunately, there is no free method to decrypt your files once they have been encrypted by this particular ransomware. Nevertheless, that may change as security researchers are hard at work and someone is bound to have a breakthrough and find a way to decrypt the files affected by this ransomware for free. We kindly invite you to find out more about this ransomware by reading this entire article.

We have received information suggesting that this particular ransomware is disseminated using malicious emails that that feature attached WSF (Windows Script File) files executed through Windows Script Host when opened. However, we have received reports that the attached file might also be a JavaScript file that runs a malicious script when opened and place Ncrypt Ransomware’s executable in its destined folder. Note that the destination folder is subject to change and varies with each case. Regardless of the distribution method used, this ransomware is set to infect a computer secretly, so if you got this malware on your PC, then you got it secretly.

Once on your computer, Ncrypt Ransomware will run automatically and scan your computer for encryptable files. Our research has revealed that it targets images, videos, audios, documents, and other types of files in an effort to encrypt valuable information for which you would be compelled to pay the ransom. While encrypting the files, this ransomware will append them with the .NCRYPT file extension at the end of the original extension. It will also drop a file named _FILE_RETRIEVAL_INSTRUCTIONS.html in each folder where files were encrypted.

If you open _FILE_RETRIEVAL_INSTRUCTIONS.html, then it will present you with a ransom note. It says that you have to pay 0.2 Bitcoins or 136.75 USD in order to get the decryption software and key. This ransomware creates a private decryption key that is sent to its Command and Control server and the only way you can get it is by paying the ransom. Theoretically, after you have paid the ransom, you have to message the cyber criminals via the provided email address including the unique user ID in the subject line and the Bitcoin transaction ID in the body of the email. We also want to note that the developers try to compel you to pay the ransom by stating in the note that if you do not pay the ransom within a set period of time, then your files will remain encrypted indefinitely.

There is no way of knowing whether Ncrypt Ransomware’s developers will keep their word and send you the decryption software and key once you have paid. Unfortunately, there is no free decryption tool to decrypt them for you. In fact, at present, it is not known whether this ransomware uses a symmetric or asymmetric encryption algorithm to encrypt your files. However, in-depth research is sure to shed light on all aspects of this infection. In the meantime, we recommend that you take decisive action against this malicious program.

In summary, Ncrypt Ransomware is a malicious application that is most likely distributed using malicious emails and is set to enter your computer secretly. Once on it, this ransomware will encrypt many of your files using a currently unknown encryption algorithm and demand that you pay a small ransom of 136.75 USD. You can remove it using the guide provided below.

How to delete this ransomware

1. Open your web browser.
2. Go to http://www.pcthreat.com/download-sph
3. Download SpyHunter-Installer.exe
4. Run its installer.
5. Perform a scan of your PC.
6. Once the scan locates Ncrypt Ransomware press Windows+E keys.
7. Enter its file path in the address line and hit Enter.
8. Right-click the .exe file and click Delete.