Scrabber Ransomware

The Scrabber Ransomware is a slightly modified version of the HiddenTear project, which means that its victims might be able to get all their files back by using one of the free HiddenTear decryptors. While the availability of a file decryption software is great news, you should not underestimate the Scrabber Ransomware’s ability to encrypt files swiftly, therefore making it impossible to access their contents. This cyber threat appears to be the product of cybercriminals who reside in the Russia region since the ransom note is written in both English and Russian. When the file-locker is initialized on a computer, it may begin to encrypt a broad range of files found on local hard drive partitions immediately.

Whenever a file is encrypted, the Scrabber Ransomware will alter its name by adding the ‘.junked’ extension (e.g. ‘photo.png’ will be renamed to ‘photo.png.junked’). After the attack is complete, the Scrabber Ransomware will drop the ransom note ‘READ BLET.txt’ as well as a Russian-named copy of the attacker’s message. Last but not least, the file-locker also may change the desktop background to an image, which features a short ransom note and the email address trinskert@bk.ru. Surprisingly, the email addresses in the wallpaper and ransom message are different – the ‘READ BLET.txt’ file urges the victims to message decriptscrabber@mail.ru.
It is not a surprise that the authors of the Scrabber Ransomware are looking to receive a significant amount of cash in exchange for the decryption tool that can help victims get their files back to normal. The good news is that there is no need to consider paying the ransom sum – the Scrabber Ransomware and other ransomware based on HiddenTear are usually decryptable via the free HiddenTear decryptor. Do not forget that you should start the file recovery task only after you have made sure to fully eliminate the Scrabber Ransomware’s files with the help of a trustworthy antivirus scanner.