Someone in your firm just opened an email attachment having no idea who sent it or what the file does. 20 minutes later no one can work because all firm documents have been encrypted and you also have no data backup or an inadequate backup in place. If you find yourself in this situation, you’re not alone. Many firms resort to paying the ransom on a ransomware attack. It is confirmed around the internet that once you pay, you will get your files back. Rekall can also confirm this, as we tested this internally in order to write this article. This guide will explain in detail the steps you must take in order to pay your ransom and get your firm data back.
Step 1. Figuring Out The Cost of Your Ransom |
The first thing we need to do is determine how much your ransom will cost. You’ll notice that in each directory where your files are encrypted there is a folder or file called “Where Are My Files” or “How to Decrypt.” You will also see an HTML file labeled similarly. We’ll need that file, so remember where it is.
Navigate to the official Tor Browser download page and download the Tor Browser. This anonymous browser may be required because you may not be able to open the HTML file with Firefox or Internet Explorer. Once installed, open the HTML file in Tor or copy and paste the link from the ransom TXT file into the Tor Browser. When the page loads, it will tell you how much you owe in Bitcoin. As this article was originally written, one Bitcoin was worth approximately $659.10 USD, although that value changes frequently. The average ransom at the time was between 2 and 4 Bitcoin.
Step 2. Bitcoin Wallet |
Next we have to create a Bitcoin wallet. This is a virtual wallet secured by encryption that will eventually hold your Bitcoin. Navigate your browser to Blockchain.com, sign up, and follow the instructions to create a Bitcoin wallet. Also download the mobile app from the Apple App Store or Google Play Store and sign in using the same credentials. This will be important during the following steps.
Convert USD to Bitcoin (Bitcoin ATM Method) |
There are many ways to purchase Bitcoin, including buying from private sellers or using cryptocurrency exchanges such as Bitstamp. Depending on your location and current regulations, certain purchasing methods may or may not be available. One option is using a Bitcoin ATM. A Bitcoin ATM is a physical kiosk that allows you to purchase Bitcoin with cash and deposit it directly into your digital wallet.
To locate a nearby Bitcoin ATM, visit Coin ATM Radar. Find the closest ATM, which is often located in convenience stores, smoke shops, or similar retail locations. Once there, follow the on-screen instructions. For a visual walkthrough, watch this Bitcoin ATM tutorial on YouTube.
Typically, you’ll enter your phone number to receive a verification code. Then open your Blockchain app, tap Receive, and display the QR code. Hold the QR code in front of the ATM scanner and insert cash. Depending on the machine’s limits, you may need to complete multiple transactions. Once complete, your Bitcoin balance should appear in your wallet.
Pay The Ransom & Get Your Files Back |
Once you are back at your computer, open the same page from Step 1 where the ransom amount was displayed. You will find a wallet ID or wallet address. Follow the instructions provided through your Blockchain account to send the appropriate amount of Bitcoin to that wallet.
After payment has been confirmed, refresh the ransom page until you receive confirmation that the payment has been received. Eventually, you should see a link to download the decryption tool. Download and run the application to begin decrypting your files. Depending on the amount of encrypted data, the process may take an hour or longer. During this time, a command prompt window may appear listing the files being decrypted. Be patient while the process completes.
Once your files have been restored, we recommend identifying the original infected computer and completely reformatting it as a precaution.
If you have questions about this process or would like Rekall Technologies to assist your firm in recovering from a ransomware attack, please call us at (800) 554-4166.