How to remove Magniber 2022 ransomware, Recover encrypted files

What is Magniber 2022 ransomware

Magniber 2022 ransomware is a new ransomware that attacks the victim’s computer by encrypting files and demanding a ransom for decrypting them. The ransomware attack can lead to data loss and financial losses. Magniber 2022 encrypts files, renames them by appending the random extension, and creates files named “readme.html” containing the ransom demand message. For example, a file named “document.docx” will be renamed to “document.docx.wehdorg”, a “image.jpg” file to “image.jpg.wehdorg”, “invoice.pdf” to “invoice.pdf.wehdorg”, and so on.

 
Magniber 2022 is new variant of the Magniber ransomware. It is created to encrypt files located on the victim’s computer, and then extort money to decrypt them. Magniber virus sneaks into the system without any visible symptoms, which is why users notice that their computer is infected too late, when the files are already encrypted. Typically, ransomware like Magniber can infect a computer when a user runs and installs the infected program as well as cracked games, freeware, key generators, fake Windows/Chrome/Edge updates and other similar software.

Each file that has been affected by Magniber 2022 is renamed in such a way that the random extension is appended to its old name on the right. This means the following, if the file was named ‘document.docx’, then after it is encrypted, it will be called ‘document.docx.wehdorg’. Each file on the victim’s computer becomes the target of Magniber virus. No matter where the file is located, on the internal drive or network storage, this file will be encrypted. Thus, the following types of files can be encrypted:

.xlgc, .vdf, .bkf, .wp4, .p7b, .mrwref, .xlsx, .litemod, .pef, .xbdoc, .wmv, .y, .xlsm, .ltx, .ztmp, .png, .fsh, .icxs, .mdf, .sb, .mcmeta, .wps, .xll, .itm, .asset, .3fr, .wpd, .forge, .sidd, .doc, .bsa, .ff, .xar, .wpl, .xyw, .zdc, .zdb, .wps, .wav, .wbmp, .snx, .lvl, .map, .rar, .bay, .xlsm, .3ds, .epk, .wbz, .eps, .gdb, .erf, .d3dbsp, .p12, .desc, .yml, .0, .sidn, .xdb, .docx, .vfs0, .webdoc, .wbk, .odt, .2bp, .xls, .x3d, .iwi, .mp4, .rtf, .xlk, .odc, .dbf, .dwg, .rb, .orf, .webp, .wmo, .rwl, .wn, .crt, .css, .bar, .vtf, .re4, .t13, .zif, .wma, .xlsb, .odp, .pdd, .wpw, .ai, .mpqge, .pptm, .wot, .kf, .dazip, .wmd, .slm, .ybk, .x, .mov, .wbc, .lrf, .wp, .ibank, .big, .fpk, .jpe, .1st, .xwp, .wpa, .wbm, .zw, .fos, .cfr, .qdf, .p7c, .odm, .avi, .wsd, .bkp, .xx, .wma, .pak, .wcf, .lbf, .rofl, .syncdb, .xpm, .ws, .xlsx, .cdr, .svg, .indd, .pdf, .flv, .dxg, .vpp_pc, .wp5, .db0, .das, .ppt, .xyp, .wpg, .cas, .vpk, .menu, .wri, .dcr, .sum, .psd, .xdl, .pem, .rgss3a, .pptx, .sav, .pkpass, .py, .zabw, .srf, .m4a, .gho, .zip, .tax, .cer, .sid, .dmp, .xls, .xy3, .mef, .wp6, .z3d, .wpd, .hplg, .xmind, .wdp, .xxx, .esm, .ysp, .ntl, .xf, .odb, .jpg, .m2, .wpt, .yal, .hvpl, .docm, .upk, .der, .wb2, .psk, .apk, .csv, .zip, .x3f, .layout, .t12, .sis, .w3x, .kdc, .wotreplay, .accdb, .1, .hkdb, .wm, .ods, .arw, .dng, .mddata, .wire, .sie, .blob, .wdb, .iwd, .wpb, .wsh, .pst, .arch00, .vcf, .pfx, .wbd, .m3u, .kdb

Encrypted files are locked, i.e. their contents cannot be accessed in any way. Renaming the files and changing their extension will not help unlock these files. In directories where there are encrypted files, the ransomware drops files called “readme.html”. These files contain a message from the ransomware authors. The content of all files with this name is the same and does not depend on which directory the file is in.

The full text of this file is:

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.

The only 1 way to decrypt your files is to receive the private key and decryption program.

Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:

1. Download ‘Tor Browser’ from https://www.torproject.org/ and install it.

2. In the ‘Tor Browser’ open your personal page here:

http://xxxxxxx.mhlx63m7qbsiovcr74v2zvjxbv7pgjarawrab7oaf4wc2mjwikhoeaad.onion/lpdyefulm

Note! This page is available via ‘Tor Browser’ only.
====================================================================================================
Also you can use temporary addresses on your personal page without using ‘Tor Browser’:

http://xxxxxxx.raredo.info/lpdyefulm

http://xxxxxxx.rarefix.info/lpdyefulm

http://xxxxxxx.ofrisk.info/lpdyefulm

http://xxxxxxx.oddcopy.info/lpdyefulm

Note! There are temporary addresses! They will be available for a limited amount of time!

The ransom demand message says that the files are not damaged, they are modified (in fact encrypted) and this modification is reversible. The only way to decrypt files is to purchase a key and a decryptor. The message also contains a link to a website where the victim can find out the amount of the ransom and how to pay it. Of course, there is no guarantee that even after paying the ransom to the attackers, the victim will be able to restore the encrypted files to their original state.

Threat Summary

Name	Magniber 2022 ransomware
Type	Crypto malware, File locker, Ransomware, Crypto virus, Filecoder
Encrypted files extension	random characters
Ransom note	readme.html
Ransom amount	BTC 0.068 (~ $2627), BTC 0.13600 (~ $5253)
Detection Names	Ransomware/Win.Magniber.R468087, Other:DangerousSig [Trj], Trojan.Siggen16.38882, W64/Kryptik.HD!tr, HEUR:Trojan-Ransom.Win64.Magni.gen, Other:DangerousSig [Trj], Trojan:Win32/Sabsik.FL.B!ml, Trojan.Win64.Injector, W64/Injector.AVT.gen!Eldorado
Symptoms	Cannot open files stored on the computer. You get an error message like ‘Windows can’t open this file’, ‘How do you want to open this file’. Your file directories contain a ‘ransom note’ file that is usually a .html, .jpg or .txt file. You have received instructions for paying the ransom.
Distribution ways	Unsolicited emails that are used to deliver malicious software. Malicious downloads that happen without a user’s knowledge when they visit a compromised web-page. Social media posts (they can be used to entice users to download malware with a built-in ransomware downloader or click a malicious link). Malvertising campaigns.
Removal	Magniber 2022 removal guide
Recovery	Recovery Guide

 

 

Text presented on this site:

MY DECRYPTOR Home Page Support Decrypt 1 file for FREE Reload current page

Your documents, photos, databases and other important files have been
LEAKED and ENCRYPTED !

WARNING! Any attempts to restore your files with the third-party software will be fatal for your files! WARNING!

To decrypt your files you need to buy the special software – “My Decryptor”

All transactions should be performed via BITCOIN network.

Within 5 days you can purchase this product at a special price: BTC 0.068 (~ $2627)

After 5 days the price of this product will increase up to: BTC 0.13600 (~ $5253)

The special price is available:

02 . 21:24:01

Some important data will be published.
To all your contacts and internet.

UNTIL FILES PUBLICATION:

07 . 21:24:01

How to get “My Decryptor”?
1. Create a Bitcoin Wallet (we recommend Blockchain.info)
2. Buy necessary amount of Bitcoins

Here are our recommendations:

Buy Bitcoins with Cash or Cash Deposit
Buy Bitcoins with Bank Account or Bank Transfer
Buy Bitcoins with PayPal
VirWoX (https://www.virwox.com/)

Could not find Bitcoins in your region? Try searching here:

BittyBot (https://bittybot.co/eu/)
How To Buy Bitcoins (https://howtobuybitcoins.info/)
Buy Bitcoin Worldwide (https://www.buybitcoinworldwide.com/)
Bitcoin-net.com (http://bitcoin-net.com/)

3. Send BTC 0.06800 to the following Bitcoin address:
1CSNDyajugHHDQFK6WJf5CYZSA99CoMGEf
4. Control the amount transaction at the “Payments History” panel below
5. Reload current page after the payment and get a link to download the software

Payments:
Total received: BTC 0.000

At the moment we have received from you: BTC 0.000 (left to pay BTC 0.06800)

Unfortunately, there is no way to decrypt files yet. Nevertheless, you do not need to despair. There are several ways to find and remove Magniber 2022 ransomware, and there is also a chance to restore part or even all encrypted files to their original state. Below we will describe in detail how to do this.

How to remove Magniber 2022 ransomware, Recover encrypted files

If your files have been encrypted by ransomware, then you need to remove the Magniber 2022 virus or be 100% sure that there is no ransomware on your computer, and then proceed to recover the files. Both the ransomware removal process and the file recovery process will take a lot of time, so do not believe the magical instructions that say that this can be done very quickly. We definitely recommend, even if for some reason one of the methods proposed below did not suit you, try another one and try all of them. Perhaps one of them will help you. Feel free to ask questions in the special section on our website or in the comments below. And the last, before proceeding with the instructions, we advise you to read it thoroughly carefully, and then print or open it on a tablet or smartphone to have it always at hand.

1. Remove Magniber 2022 ransomware virus
2. Restore encrypted files
3. Protect your PC from Magniber 2022 ransomware

Remove Magniber 2022 ransomware virus

First, perform a full system scan of the computer using free malware removal tools capable of detecting and removing ransomware infection.

Zemana Anti Malware (ZAM) can remove ransomware, as well as a spyware, trojans, worms, rootkits and other malware. After the detection of the Magniber 2022 ransomware, you can easily and quickly delete it.

Visit the following page to download Zemana. Save it on your desktop.

Once the download is complete, close all software and windows on your system. Open a directory in which you saved it. Double-click on the icon that’s called Zemana.AntiMalware.Setup as displayed on the screen below.

When the install begins, you will see the “Setup wizard” that will help you install Zemana on your computer.

Once installation is done, you will see window such as the one below.

Now press the “Scan” button to perform a system scan with this utility for the Magniber 2022 ransomware, other malware, worms and trojans. This task can take some time, so please be patient.

Once the scan get finished, it will open the Scan Results. Make sure to check mark the items which are unsafe and then click “Next” button.

The Zemana Anti Malware will begin to remove Magniber 2022 ransomware virus, other malicious software, worms and trojans.

If you are having problems with the Magniber 2022 removal, then use Kaspersky virus removal tool (KVRT). It is a free removal tool that can be downloaded and run to remove ransomware, adware, spyware, trojans, worms, potentially unwanted programs, malicious software and other security threats from your personal computer. You can run this utility to detect threats even if you have an antivirus or any other security application.

Download Kaspersky virus removal tool from the following link.

Once the downloading process is finished, double-click on the Kaspersky icon. Once initialization process is finished, you’ll see the KVRT screen similar to the one below.

Click Change Parameters and set a check near all your drives. Click OK to close the Parameters window. Next click Start scan button to perform a system scan for the Magniber 2022 crypto virus and other malware. This procedure can take quite a while, so please be patient. While the Kaspersky virus removal tool utility is scanning, you can see count of objects it has identified as being affected by malicious software.

After finished, KVRT will open a list of all items found by the scan as displayed on the image below.

Make sure all items have ‘checkmark’ and press on Continue to begin a cleaning process.

Recover encrypted files

If all your files are encrypted by Magniber 2022, then you only have one thing left, use alternative methods to restore the contents of the encrypted files. There are several alternative methods that may allow you to restore the contents of encrypted files. These methods of file recovery do not use decryption, so there is no need for a key and decryptor. Before you begin, you must be 100% sure that the computer does not have active ransomware. Therefore, if you have not yet checked your computer for ransomware, do it right now, use free malware removal tools or return to step 1 above.

Restore encrypted files using Shadow Explorer

A free tool named ShadowExplorer is a simple solution to use the ‘Previous Versions’ feature of MS Windows 10 (8, 7 , Vista). You can recover your documents, photos, and music encrypted by Magniber 2022 ransomware from Shadow Copies for free. Unfortunately, this method does not always work due to the fact that the ransomware almost always deletes all Shadow copies.

Installing the ShadowExplorer is simple. First you will need to download ShadowExplorer on your system from the link below.

After the download is done, extract the saved file to a directory on your personal computer. This will create the necessary files as on the image below.

Run the ShadowExplorerPortable program. Now choose the date (2) that you want to restore from and the drive (1) you wish to recover files (folders) from such as the one below.

On right panel navigate to the file (folder) you want to recover. Right-click to the file or folder and click the Export button like below.

And finally, specify a directory (your Desktop) to save the shadow copy of encrypted file and click ‘OK’ button.

This video step-by-step guide will demonstrate How to recover encrypted files using Shadow Explorer.

Recover encrypted files with PhotoRec

There is another way to recover the contents of the encrypted files. This method is based on using data recovery tools. We recommend using a tool called PhotoRec. It has all the necessary functions and is completely free.

Download PhotoRec by clicking on the following link.

Once downloading is complete, open a directory in which you saved it. Right click to testdisk-7.0.win and select Extract all. Follow the prompts. Next please open the testdisk-7.0 folder as on the image below.

Double click on qphotorec_win to run PhotoRec for MS Windows. It will open a screen as displayed in the figure below.

Select a drive to recover like below.

You will see a list of available partitions. Select a partition that holds encrypted files as shown below.

Press File Formats button and specify file types to recover. You can to enable or disable the restore of certain file types. When this is finished, press OK button.

Next, press Browse button to choose where restored personal files should be written, then press Search. We strongly recommend that you use an external device to save the restored files!

Count of recovered files is updated in real time. All restored personal files are written in a folder that you have chosen on the previous step. You can to access the files even if the restore process is not finished.

When the restore is finished, press on Quit button. Next, open the directory where restored documents, photos and music are stored. You will see a contents as displayed below.

All recovered documents, photos and music are written in recup_dir.1, recup_dir.2 … sub-directories. If you are searching for a specific file, then you can to sort your recovered files by extension and/or date/time.

This video step-by-step guide will demonstrate How to recover encrypted files using PhotoRec.

Protect your PC from Magniber 2022 ransomware

Most antivirus programs already have built-in protection system against the ransomware. Therefore, if your machine does not have an antivirus program, make sure you install it. As an extra protection, use the HitmanPro.Alert. All-in-all, HitmanPro.Alert is a fantastic utility to protect your computer from any ransomware. If ransomware is detected, then HitmanPro.Alert automatically neutralizes malware and restores the encrypted files. HitmanPro.Alert is compatible with all versions of MS Windows operating system from MS Windows XP to Windows 10.

First, click the following link, then click the ‘Download’ button in order to download the latest version of HitmanPro.Alert.

After the downloading process is complete, open the file location. You will see an icon like below.

Double click the HitmanPro.Alert desktop icon. After the tool is started, you’ll be displayed a window where you can choose a level of protection, as displayed below.

Now click the Install button to activate the protection.

Finish words

This guide was created to help all victims of the Magniber 2022 ransomware. We tried to give answers to the following questions: how to remove ransomware; how to recover encrypted files. We hope that the information presented in this manual has helped you.

If you have questions, then write to us, leaving a comment below. If you need more help with Magniber 2022 related issues, go to here.