Do you know what Unlock26 Ransomware is?
Cyber security experts have recently tested a malicious application called Unlock26 Ransomware and found that it was designed to encrypt your personal files and then offer you to buy a decryption key to decrypt them. However, researchers say that you should remove it instead because there is no way to know if you will get the key once you have paid. This particular ransomware’s developers feature it as a Ransomware-as-a-Service (RaaS), so other people can get their hands on it, distribute it and make money off it. Indeed, the primary objective of this ransomware is to extort money from you, please read this whole description to find out more.
Our malware analysts have found that Unlock26 Ransomware’s developers have also created an application called Ransomware Builder that enables the people that have access to it to build a custom Unlock26 Ransomware version. This builder is featured on a website that is dedicated to distributing it. The site also features the core file of this ransomware. The Builder allows the would-be hacker to modify certain settings such as specifying the Bitcoin wallet address to which the victim has to transfer the ransom. The amount to be paid for victims in all countries as well as the amount for individual countries, so the user can set a larger payment for countries where people make more money. We want to note that the cyber criminals get 50 % of the profits and the other 50 % goes to the developers that provide this service. The user can also set the particular file extension for this ransomware to encrypt and can command the ransomware to encrypt the first 4 MB of the files only. The files will still be inaccessible to the users, and the only way for them to get their files back is to purchase the decryption key from the cyber criminals.
Unlock26 Ransomware screenshot
Scroll down for full removal instructions
Unlock26 Ransomware uses an advanced encryption algorithm that creates a unique encryption and decryption key. The decryption key is uploaded to this ransomware’s command and control server hosted at 192.36.27.5 in Sweden. The cyber criminals can see general information about their victims that include Country, Application ID, Price, Date, Status, and Action. While encrypting the files, this ransomware appends the encrypted files with either a ReadMe-1RU.html or ReadMe-k7K.html extension. Once the encryption is complete, it will delete all shadow copies of the files and drop its ransom note named ReadMe-{random ID}.html. So there you have it, this is what you will have to deal with if your PC becomes infected with this ransomware.
Unfortunately, there is no telling how this ransomware might be distributed because it can have many cyber criminals distributing it. As we have mentioned previously, the developers offer this ransomware’s builder on a dedicated distribution site, but the people that get it can distribute the finished ransomware any way they want. So, they can opt for sending the ransomware via email, have it bundled with pirated software installers, or have infected websites automatically download it when you visit them.
You might want to remove Unlock26 Ransomware because there is no guarantee that you will get the decryption key once you have paid. Also, the cost of the decryption key might be too high. If you want to remove this ransomware, then we invite you to use our manual removal guide that includes using SpyHunter, an antimalware application, to detect the malicious file.
How to delete this ransomware
- Type http://www.spyware-techie.com/download-sph in the browser’s address box.
- Hit Enter.
- Download SpyHunter-Installer.exe and run it.
- Install the program, run it and click Scan Computer Now!
- After the scan is complete copy the file path of the malicious file from the scan results.
- While in desktop, simultaneously press Win+E.
- Type the file path of the file in File Explorer’s address box and hit Enter.
- Right-click the file and click Delete.
- Empty the Recycle Bin.
In non-techie terms:
Unlock26 Ransomware is a malicious program that can infect your computer secretly if it is not protected by an anti-malware program. If it manages to get onto your PC, then it will encrypt your files and then drop its ransom note that demands that you pay for the decryption key to get your files back. However, you should not comply with the cyber criminals’ demands and remove this infection.