Ransom.Encoded01

Short bio

Ransom.Encoded01 is Malwarebytes' detection name for a a Ransomware-as-a-Service (RaaS) strain which is also known as Sugar ransomware.

Symptoms

Encrypted files receive the ‘encoded01’ extension. After encryption a ransom note will be created that says:

[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension .encoded01.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant
return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our
work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt 1-5 files for free. That
our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause
just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You can open our site by the shortcut "SUPPORT (TOR_BROWSER)" created on the desktop.
Also as the second option you can install the tor browser:
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website. Full link will be provided below.
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions
its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything
for restoring, but please should not interfere.
!!! !!! !!!
-----------------------------------------------------------------------------------------

Type and source of infection

Ransom.Encoded01 is ransomware as a service. Ransomware in general makes files on the victims system unusable until the ransom is paid. Ransomware as a service can be delivered in many ways, which depend on the affiliate that is deploying the ransomware. For now, Ransom.Encoded01 seems to target home users rather than organizations.

Protection

Home remediation

Malwarebytes can detect and remove Ransom.Encoded01 without further user interaction.

1. Please download Malwarebytes to your desktop.
2. Double-click MBSetup.exe and follow the prompts to install the program.
3. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
4. Click on the Get started button.
5. Click Scan to start a Threat Scan.
6. Click Quarantine to remove the found threats.
7. Reboot the system if prompted to complete the removal process.

Take note, however, that removing this ransomware does not decrypt your files. You can only get your files back from backups you made before the infection happened.

Business remediation

How to remove Ransom.Encoded01 with the Malwarebytes Nebula console

You can use the Malwarebytes Anti-Malware Nebula console to scan endpoints.

Nebula endpoint tasks menu

Choose the Scan + Quarantine option. Afterwards you can check the Detections page to see which threats were found. On the Quarantine page you can see which threats were quarantined and restore them if necessary. All component/technology detections are passed to the remediation engine for complete removal from infected systems. This industry leading technology uses patented techniques in identifying all cohorts or associated files for a single threat and removes them all together to prevent malware from resuscitating itself. If you are using Malwarebytes Ransomware Rollback technology, it allows you to wind back the clock to negate the impact of ransomware by leveraging just-in-time backups.