How to Recover from the EvilNominatus Ransomware Attack
File-lockers are still one of the most dangerous types of malware to encounter online. They have the ability to inflict long-lasting damage to your files, and recovering from their attacks is often a very challenging task. One of the latest file-encryption Trojans to be discovered online goes by the name EvilNominatus Ransomware. It is not affiliated with any of the active or popular ransomware families at the moment. Instead, it seems to be a new project whose creators have written it from scratch.
Unfortunately, the fact that EvilNominatus Ransomware is not part of an established ransomware family is not good news. It still packs a working file-encryption algorithm, which appears to be impossible to reverse engineer and crack. Victims of the EvilNominatus Ransomware might be unable to recover their files via free utilities. Currently, the only reliable way to undo the damage is to restore the files from a backup.
The EvilNominatus Ransomware marks filenames with the '-Lokced' suffix. It then displays a ransom message in a new pop-up window, which prompts the user to enter an unlock code. To disable the screenlocker, victims can enter the code 7HJA817273-zXhsgSUS89-XX98UYHBVZ-9182TEFGIJK. However, this does not undo the damage done to the data. The pop-up asks users to contact bkhtyaryrwzbh@gmail.com if they wish to find out how to restore their files. We would not advise you to trust the criminals behind this campaign, because it is highly unlikely that they will agree to help you without demanding an outrageous ransom fee. As you can probably guess, sending money to anonymous ransomware developers is a bad idea. Victims of the EvilNominatus Ransomware should run an antivirus tool to terminate the threat, and then try out popular data recovery options.
