Resurrection Ransomware Removal Guide

Resurrection Ransomware is the newest addition to the Hidden-Tear ransomware family. Like its counterparts, it was designed to encrypt your files secretly and then and then demand that you pay a hefty ransom payment for the decryption key. Thankfully, this ransomware has been released before it can be completed fully. The resulting ransomware is incapable of encrypting any files as its control and command server is down. Therefore, you need not hesitate and remove this malicious program before it can do any damage to it. In this short description, we will discuss how it is distributed, how it works, and how you can get rid of it from your PC safely.

Let us begin our analysis with how this ransomware is distributed. Apparently, the original developers of the Hidden-Tear project have since dropped it. However, someone else picked up where the real developers left off and started developing new ransomware-type infections. Our research has shown that Resurrection Ransomware is similar to Decryption Assistant Ransomware and Korean Ransomware, but there are more Hidden-Tear-based ransomware that include CryptoKill Ransomware, Kill Zorro Ransomware, and several others.

While there is not enough information to conclude the actual methods used to distribute Resurrection Ransomware, we believe that the new developers use malicious email spam to distribute this particular ransomware far and wide. It does not target any specific demographic or country, and we think that it is intentionally distributed around the globe to get as many computers infected as possible. We believe that the creators use email spam to distribute this particular ransomware. The emails might not contain much information but have an attached file that when opened would infect your PC with Resurrection Ransomware. The file can be disguised as a PDF file. The developers might name this ransomware as “invoice.pdf____.exe.” If they make the underscores long enough, the email might not show that the final and real extension is that of an executable file. If you download and run or just temporarily open the file, then this ransomware would immediately start encrypting your files.

However, since it does not connect to a command and control server, it does not receive instructions to encrypt and also does not receive the encryption key. Nevertheless, regardless of whether it encrypts your files, this ransomware drops a ransom note named README.html which is an HTML file on the desktop on and also in %HOMEDRIVE% and %USERPROFILE% folders. It also drops a file named “Recovery.key” that should contain information, but this file remains empty as there is no connection to the C&C server. Also, the ransom note features and audio source in its code ("http://topalbums.biz/file/8999896.mp3"). As a result, the file plays a song while it is open.

The ransomware itself was designed to encrypt your files with an AES encryption algorithm. It targets many file formats that include but are not limited to .3g2, .3gp, .otg, .otp, .ots, .xlsm, .xlsx, .xlt, .png, .pot, .potm, .potx, and .potx. This ransomware was configured to encrypt more than a hundred file formats, so many of your personal, value files can be encrypted by it. While encrypting, Resurrection Ransomware would append the encrypted files with a ".resurrection" file extension which it does not do in its current state. This ransomware demands that you pay 1.77 BTC (3,918 USD or 3,500 EUR) which is an outrageous sum of money that you should not contemplate paying.

In closing, Resurrection Ransomware is a potentially highly dangerous computer infection that could encrypt most of your files on your PC. The good news is that it does not work due to the fact it still being in development. Regardless, you ought to remove it from your PC as soon as possible. Please see the manual removal guide below or get an antimalware program such as SpyHunter to detect all of its files and delete them automatically.

Delete Resurrection Ransomware manually

1. Press Win+E keys.
2. In File Explorer’s address box, type the following file paths and press Enter.
   • %USERPROFILE\Downloads
   • %USERPROFILE\Desktop
   • %TEMP%
3. Locate the main executable file.
4. Right-click it and click Delete.
5. Then, go to %HOMEDRIVE% and %USERPROFILE%
6. Locate README.html and delete it.
7. Finally, go to the desktop and delete README.html and Recovery.key
8. Empty the Recycle Bin.