Computer criminals have devised several versions of a dangerous new malware known as MerryChristmas ransomware. Read our removal guide to learn more about the virus.
About The MerryChristmas Ransomware
MerryChristmas Ransomware is a new ransomware virus which has spawned several versions made by the various computer hackers.
The viruses are known under different other aliases including MRCR1, MRCR, Merry X-Mas and RMCM1 ransomware. The first iteration of the malware targets a large list of target user file types:
.001, .1cd, .3d, .3d4, .3df8, .3dm, .3ds, .3fr, .3g2, .3ga, .3gp, .3gp2, .3んん, .3pr, .7と, .7zip, .8ba, .8bc, .8be, .8bf, .8bi8, .8bl, .8bs,
.8bx, .8by, .8li, .a2c, .aa, .aa3, .aac, .aaf, .ab4, .abb, .abw, .ac2, .ac3, .accdb, .accde, .accdr, .accdt, .エース, .ach, .acr, .行為, .adb, .ade, .名前,
.adp, .adpb, .adr, .ads, .adt, .aep, .aepx, .aes, .aet, .afp, .agd1, .agdl, .ai, .aif, .aiff, .目的, .aip, .バック, .ait, .ak, .al, .allet, .alphacrypt, .amf,
.amr, .amu, .amx, .amxx, .年, .aoi, .ap, .類人猿, .api, .apj, .apk, .apnx, .app, .アーク, .arch00, .アリ, .arj, .アロ, .arr, .arw, .as, .as3, .そう, .asc, .ascx,
.ase, .asf, .ashx, .asm, .asmx, .asp, .aspx, .asr, .資産, .asx, .automaticdestinations-ms, .avi, .avs, .awg, .azf, .azs, .azw, .azw1, .azw3, .azw4, .b2a,
.バック, .バックアップ, .backupdb, .bad, .後ろに, .バンク, .バー, .コウモリ, .ベイ, .bc6, .bc7, .bck, .bcp, .bdb, .bdp, .bdr, .bfa, .bgt, .bi8, .よだれかけ, .ビック, .大きい, .ビック, .置き場,
.bkf, .bkp, .bkup, .ブレンド, .ブロブ, .blp, .bmc, .bmf, .bml, .bmp, .boc, .bp2, .bp3, .bpk, .bpl, .bpw, .brd, .できる, .bsk, .例えば, .btoa, .bvd, .bz2, .c, .キャグ,
.カム, .camproj, .キャップ, .車, .場合, .cat, .cbf, .cbr, .cbz, .cc, .ccd, .ccf, .cch, .cd, .cdf, .cdi, .cdr, .cdr3, .cdr4, .cdr5, .cdr6, .cdrw, .cdx, .ce1,.ce2,
.cef, .cer, .cert, .cfg, .cfm, .cfp, .cf., .cgf, .cgi, .cgm, .cgp, .chk, .chml, .cib, .クラス, .clr, .cls, .clx, .cmd, .cmf, .cms, .cmt, .cnf, .cng, .タラ,
.col, .と, .conf, .設定, .contact, .cp, .cpi, .cpio, .cpp, .cr2, .クロウ, .crd, .crt, .crw, .crwl, .crypt, .暗号化, .cryptra, .cryptXXX, .cs, .csh, .csi,
.csl, .チューブ, .csr, .css, .csv, .ctt, .会社, .cue, .cwf, .d3dbsp, .dac, .から, .dap, .インクルード, .dash, .dat, .data, .database, .dayzprofile, .dazip, .db,
.db_journal, .db0, .db3, .dba, .dbb, .dbf, .dbfv, .db-journal, .dbx, .dc2, .dc4, .dch, .dco, .dcp, .dcr, .dcs, .dcu, .ddc, .ddcx, .ddd, .ドック, .drw, .dds,
.デフォルト, .インクルード, .の, .des, .説明, .設計, .desklink, .開発者, .dex, .dfm, .dgc, .12月, .dif, .神々, .dim, .dime, .dip, .あなたへ, .directory, .disc, .ディスク, .dit,
.divx, .言う, .djv, .djvu, .dlc, .dmg, .dmp, .沿って, .ドブ, .doc, .docb, .docm, .docx, .ドット, .dotm, .dotx, .dox, .dpk, .海抜, .dpr, .drf, .drw, .dsk, .dsp, .dtd,
.DVD, .二, .dvx, .dwg, .dxb, .dxe, .dxf, .dxg, .e4a, .edb, .efl, .efr, .efu, .efx, .eip, .妖精, .emc, .emf, .eml, .enc, .enx, .epk, .eps, .epub, .eql,
.erbsql, .erf, .エラー, .esf, .esm, .euc, .evo, .ex, .exf, .exif, .f90, .よくある質問, .FCD, .fdb, .fdr, .fds, .ff, .ffd, .fff, .fh, .fhd, .fla, .fla, .flf, .flp, .flv,
.flvv, .にとって, .フォージ, .fos, .fpenc, .fpk, .fpp, .fpx, .frm, .fsh, .fss, .fxg, .gadget, .ガム, .gbk, .gbr, .gdb, .ged, .gfe, .gfx, .ゴー, .gif, .gpg, .gpx,
.グレー, .グレー, .grf, .グループ, .gry, .gthr, .gxk, .gz, .gzig, .gzip, .h, .h3m, .h4r, .hbk, .hbx, .hdd, .hex, .hkdb, .hkx, .hplg, .hpp, .hqx, .htm, .html,
.htpasswd, .hvpl, .hwp, .ibank, .ibd, .ibooks, .ibz, .ico, .icxs, .idl, .idml, .idx, .ie5, .ie6, .ie7, .ie8, .ie9, .iff, .iif, .iiq, .img, .ない, .indb,
.indd, .indl, .int, .インク, .inx, .ipa, .iso, .問題, .isz, .itdb, .itl, .itm, .iwd, .私は、Wi, .jac, .jar, .Jav, .java, .jbc, .jc, .jfif, .jge, .jgz, .jif, .ジフ,
.jks, .jnt, .jpc, .jpe, .jpeg, .jpf, .jpg, .jpw, .js, .json, .jsp, .just, .k25, .kc2, .kdb, .kdbx, .kdc, .kde, .key, .kf, .klq, .kml, .kmz, .kpdx, .kwd,
.kwm, .laccdb, .lastlogin, .lay, .lay6, .レイアウト, .lbf, .lbi, .lcd, .lcf, .lcn, .ldb, .ldf, .lgp, .lib, .lit, .litemod, .lngttarch2, .localstorage, .ロッキー,
.ログ, .lp2, .lpa, .lrf, .ltm, .ltr, .ltx, .lua, .lvivt, .レベル, .m, .m2, .m2ts, .m3u, .m3u8, .m4a, .m4p, .m4u, .m4v, .mag, .おとこ, .地図, .mapimail, .最大, .mbox,
.mbx, .mcd, .mcgame, .mcmeta, .mcrp, .md, .md0, .md1, .md2, .md3, .md5, .mdb, .mdbackup, .mdc, .mdf, .mdl, .mdn, .mds, .mef, .メニュー, .meo, .mfd, .mfw, .マイク,
.mid, .mim, .mime, .mip, .mjd, .mkv, .mlb, .mlx, .mm6, .mm7, .mm8, .mme, .mml, .mmw, .mny, .mobi, .モッド, .マネーウェル, .mos, .mov, .movie, .moz, .mp1, .mp2,
.mp3, .mp4, .mp4v, .mpa, .mpe, .mpeg, .mpg, .mpq, .mpqge, .mpv2, .mrw, .町, .ms11(Securitycopy), .ms11, .mse, .msg, .msi, .msp, .mts, .mui, .mxp, .myd,
.myi, .ない, .ncd, .ncf, .nd, .ndd, .ndf, .nds, .nef, .nfo, .nk2, .nop, .note, .今, .nrg, .nri, .nrw, .ns2, .ns3, .ns4, .nsd, .nsf, .nsg, .nsh, .ntl,
.number, .nvram, .nwb, .nx1, .nx2, .nxl, .nyf, .oab, .obj, .odb, .エピソード, .odf, .odg, .odi, .odm, .応答, .ods, .odt, .多くの場合, .oga, .ogg, .oil, .opd, .opf, .orf,
.ost, .otg, .oth, .otp, .ots, .ott, .フクロウ, .oxt, .p12, .p7b, .p7c, .助けて, .pack, .ページ, .その後, .paq, .pas, .pat, .pbf, .pbk, .pbp, .pbs, .pcd, .pct, .PVC,
.pdb, .pdc, .pdd, .pdf, .ペフ, .ペム, .pfx, .php, .pif, .pkb, .pkey, .pkh, .pkpass, .pl, .plb, .plc, .もっと, .plugin, .plus_muhd, .午後, .pmd, .png, .po, .ポット,
.ポットム, .potx, .ppam, .ppd, .ppf, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prc, .prel, .prf, .priv, .privat, .props, .prproj, .prt, .ps, .犬, .psafe3,
.psd, .psk, .pspimage, .PST, .psw6, .ptx, .pub, .puz, .pwf, .価格, .pwm, .pxp, .py, .qba, .qbb, .qbm, .qbr, .qbw, .qbx, .qby, .qcow, .qcow2, .qdf, .qed,
.一瞬で, .qic, .qif, .qpx, .qt, .qtq, .qtr, .r00, .r01, .r02, .r03, .r3d, .でる, .ra2, .raf, .ram, .rar, .rat, .生, .rb, .rdb, .rdi, .re4, .解像度, .result, .rev,
.rgn, .rgss3a, .リム, .rll, .rm, .rng, .rofl, .rpf, .rrt, .rsdf, .rsrc, .rss, .rsw, .rte, .rtf, .rts, .rtx, .ラム, .実行, .rv, .rvt, .rw2, .rwl, .rwz, .rzk,
.rzx, .s3db, .悲しい, .ピュア, .安全, .sas7bdat, .sav, .保存する, .say, .sb, .sc2save, .sch, .scm, .scn, .scx, .sd0, .sd1, .sda, .sdb, .sdc, .sdf, .sdn, .sdo, .sds,
.tsp, .search-ms, .sef, .その, .ses, .sfs, .sfx, .sgz, .sh, .shar, .shr, .shw, .shy, .sid, .sidd, .sidn, .君は, .sis, .sitx, .sldm, .sldx, .slk, .こんにちは, .sln,
.こんにちは, .sme, .snk, .snp, .snx, .そう, .spd, .spr, .sql, .sqlite, .sqlite3, .sqlitedb, .sqllite, .sqx, .sr2, .srf, .srt, .srw, .に, .st4, .st5, .st6, .st7,
.st8, .stc, .std, .sti, .stm, .stt, .stw, .stx, .南, .suf, .和, .svg, .すべて, .svr, .swd, .swf, .switch, .sxc, .sxd, .sxg, .sxi, .sxm, .sxw, .syncdb, .t01,
.t03, .t05, .t12, .t13, .タール, .tar.bz2, .tarbz2, .税金, .tax2013, .tax2014, .tbk, .tbz2, .tch, .tcx, .teslacrypt, .tex, .テキスト, .tg, .tga, .tgz, .thm, .thmx,
.tif, .tiff, .tlb, .tlg, .tlz, .tmp, .toast, .tor, .トレント, .tpu, .tpx, .trp, .ts, .君は, .そこ, .txd, .txf, .txt, .uax, .udf, .uea, .umx, .unity3d, .unr,
.unx, .一般に, .uot, .upk, .upoi, .url, .米国, .usx, .ut2, .ut3, .UTC, .utx, .uu, .uud, .uue, .uvx, .uxx, .val, .vault, .vb, .vbox, .vbs, .君は, .vcd, .vcf,
.vcxpro, .vdf, .vdi, .vdo, .見る, .vfs0, .vhd, .vhdx, .vlc, .vlt, .vmdk, .vmf, .vmsd, .vmt, .vmx, .vmxf, .vob, .vp, .vpk, .vpp_pc, .全員, .vtf, .w3g, .w3x,
.wab, .ワッド, .財布, .戦争, .wav, .波, .ワウ, .wb2, .wbk, .wdgt, .週, .wm, .wma, .wmd, .wmdb, .wmmp, .wmo, .wmv, .wmx, .wotreplay, .ワオ, .wpd, .wpe, .wpk,
.wpl, .wps, .wsf, .wsh, .wtd, .wtf, .wvx, .x11, .x3f, .xcodeproj, .xf, .xhtml, .xis, .xl, .xla, .xlam, .xlc, .xlk, .xll, .xlm, .xlr, .xls, .xlsb, .xlsm,
.xlsx, .xlt, .xltm, .xltx, .xlv, .xlw, .xlwx, .xml, .xpi, .xps, .xpt, .xqx, .xsl, .xtbl, .xvid, .xwd, .xxe, .xxx, .ヤブ, .ycbcra, .yenc, .yml, .ync, .yps,
.yuv, .z02, .z04, .ザップ, .zip, .zipx, .動物園, .zps, .ztmp
The compromised files receive the .RMCM1 extension.
The ransomware note associated with this version displays the following message:
ALL COMPUTER DATA ENCRYPTED!
00:00:00TIME AFTER ALL FILES WILL BE DELETED
YOUR ID AAED4F4B621E5EFE5B582A8486ABD8C5
NOW YOU NEED TO PAY TO RECOVER YOUR DATA
AFTER THE MONEY TRANSFER YOU WILL RECEIVE THE DECRYPTORCONTACTS
TELEGRAM @comodosecurity
EMAIL [email protected]Any attempts to return your files with the third-party tools can be fatal for your encrypted files!
The most part of the third-party software change data within the encrypted file to restore it but
this causes damage to the files.
Finally it will be impossible to decrypt your files! There are several plain steps to restore your
files but if you do not follow them we will not be able to help you!
The second version of the MerryChristmas Ransomware is simply known as New MerryChristmas Ransomware Virus. It uses the same ransomware note. We assume that it targets the same file types, the only difference is that the compromised data are encrypted and renamed with the .RMCM1 extension.
How Does The MerryChristmas Ransomware Infect Computers
All versions of the MerryChristmas Ransomware are distributed mainly by spam email messages that contain links to infected binaries or attach them directly to the emails.
It is believed that the hackers behind the virus have spread the Globe2 ransomware and other malware against a variety of users. Other ways of spreading the virus include direct attack campaigns and using malicious ads and browser hijackers.
How To Remove The MerryChristmas Ransomware and Recover Affected Files
信頼できるスパイウェア対策ソリューションを使用して、アクティブな感染を除去し、コンピューターを保護できます .