How to Remove Boris Ransomware?

What is Boris Ransomware and how does it work?

Boris Ransomware is a file encryption malware that encrypts files using AES-256 cipher algorithm and is based on the infamous HiddenTear Ransomware family.

Once installed on the system via malicious websites, spam email attachments the ransomware scans the PC to search for files with the following extensions and encrypts them with the sophisticated cypher algorithm.

.PNG, .GIF, .JPG, .PDF, .XLR, .XLS, .XLSX, .SQL, .APK, .COM, .EXE, .JAR,.CAD Files, .CSS, .HTML .PHP,.DOC, .DOCX, .LOG, .TXT, .CSV, .KEY, .PPT .PPTX and many more.

The encrypted files are appended with [decode77@sfetter.com].boris extension.

For instance a file named “abc.pdf” would be renamed to “abc.pdf.[decode77@sfetter.com].boris” which is completely unusable.

Victims are informed about this unfortunate circumstance by dropping a ransom note file “README.txt” that does not disclose much and reads as:

There are two version known of this ransom note-one in English and another in Russian.This implicates that Boris ransomware either specifically targets people from these countries, or its developers might be Russian or English.

Decryption tool is stored on the remote servers of cyber miscreants and restoring the files could be almost impossible without it.The sole motive behind this rogue attempt is to earn easy money by exploiting victims.

However users are recommended not to attempt to contact criminals as:

1. Cybermiscreants usually refuse to provide the decryption key once the ransom is received.
2. On knowing that the victim is ready to pay the ransom, crooks can optimize similar attacks on the same PC again in the future.
3. Instead of providing the decryption key to the victims, hackers could send a malicious script that would make the system vulnerable to other system infections.

Alternatives for data recovery for the victims:

1. To be on a safer side users are always recommended to maintain regular data backup on a remote server or unplugged storage devices like external HDD, USB stick as well as virtual cloud services.
2. Use of third-party software that might help you with file decryption.
3. Rely on an independent security researcher to crack malware code and create a decryption key.

Boris Ransomware spread techniques-

Boris ransomware is distributed via various ways and is coded to obfuscate from antivirus or any other protection software installed in the system to evade detection.

Read Full Artical