BlackRose Ransomware

BlackRose Ransomware is a ransomware infection which, unlike some highly complex ransomware threats, only encrypts files. File encryption is one of the most noticeable symptoms of ransomware, but deep inside the system multiple complex changes are made. In the case of the BlackRose Ransomware, no changes in the registry or other parts of the operating system have been observed. The BlackRose Ransomware encrypts files and creates a .txt containing a so-called ransom note, which provides information of what should be done in order to regain access to the encrypted data. It is crucial to ignore the demand provided as it is unlikely that the damaged data will be decrypted.

Even though the BlackRose Ransomware lacks some typical features, it does encrypts mostly used files, including images and documents. After encryption, the compromised files can be recognized by the file extensions .jpg.okokokokok, .jpg.ranranranran, and .jpg.whatthefuckm appended. To intimidate the user of the victimized computer, the ransomware drops a ransom message in the text file named READ_IT_FOR_GET_YOUR_FILE with the following message:

Files has been encrypted
Send me some 1 bitcoins or more
to Address BITCOIN :
3Q2hTDPt1LMAAgQsNQAPJQxb9ZiwADYaFM

After Payment bitcoin please send your Address Bitcoin Payment to me at

black-rose@outlook.co.th

I will give File Decryptor for you in 24HR...

As the ransom suggest, the victim is supposed to buy bitcoins, digital currency, and send the money to a specific wallet. According to the attacker, the victim has to pay 1 bitcoin, which is over 1,000 US dollars. The transaction is supposed to be made within 24 hours, and after receiving the payment the attacker promises to send a program named File Decryptor. The name of the program suggests that that program is an executable which decrypts the encrypted files. The odds are that such a program does not even exist but is mentioned in order to persuade victims that they have a chance to get control over their data.

As for the email address black-rose@outlook.co.th, the domain extension co.th suggests that the attacker might be located in Thailand. Moreover, the file name extensions added may also be a clue about the identity of the attacker; however, no research on that have been carried out so far. In any case, there is no reason for following the instructions provided by the attacker as the BlackRose Ransomware has to be removed from the computer.

The wording of the message and the way the BlackRose Ransomware works suggest that the attacker behind the infection has only started out on a career as a hacker. There are multiple similar cases of ransomware when a little number of computers is affected. Even though such ransomware infections stop being distributed at some point, they do cause harm, which can be prevented. Internet security should be given the highest priority by Internet-savvy computer users, which means that a reliable security program should be running on any computer connected to the Internet. The BlackRose Ransomware is one of millions malware infections, which are launched to the wild every day in high numbers. If it is too late for you to prevent the BlackRose Ransomware from accessing your PC, you should remove the threat without any delay.

Ransomware, as well as other money-oriented software programs, can spread in multiple ways, including spam emails, software bundles, malicious links, etc. Threats like the BlackRose Ransomware can corrupt your date after you click on a fake download button or a link on an unreliable forum website. If you do care about your online safety and want to browse the Internet safely, avoid visiting questionable websites as they may be a source of multiple infections.

Our advice is to rely on a security program that can remove the BlackRose Ransomware and fight off multiple other ransomware infections as well as other types of malware. You want to be sure that you can connect to the Internet safely, so do not hesitate to implement a powerful tool. Our instructions below should help you remove the BlackRose malware, but you should bear in mind that it is worth checking the whole system for malicious files that might be hidden deep in the system.

BlackRose Ransomware Removal

1. Open Windows Explorer by pressing Win+E.
2. Press Enter.
3. Open the Downloads folder and delete recently downloaded files.
4. If downloaded files are placed on the desktop, the Desktop folder should be checked as well.
5. Empty the Recycle bin.