Loches is a type of ransomware from the GlobeImposter family. It encrypts users’ files, rendering them unreadable until the victim pays a ransom. The ransomware is designed to cause significant damage by locking up important files and demanding payment for their decryption. This particular strain appends the “.loches” extension to the files it encrypts, making it easy to spot the affected files. Loches is notorious for its elaborate ransom notes and aggressive tactics, warning victims against using third-party tools to restore their files.
Threat Overview
The following table summarizes the key details of the Loches ransomware:
| Threat Name | Loches Ransomware |
|---|---|
| Threat Type | Ransomware, Crypto Virus, File Locker |
| Encrypted File Extension | .loches |
| Ransom Note File Name | how_to_back_files.html |
| Associated Email Addresses | rudolfbrendlinkof1982@tutamail.com, robertokarlosonewtggg@outlook.com |
| Detection Names | Avast (Win32:RansomX-gen [Ransom]), Combo Cleaner (Generic.Ransom.GlobeImposter.599F404E), ESET-NOD32 (A Variant Of Win32/Filecoder.FV), Kaspersky (HEUR:Trojan.Win32.Generic), Microsoft (Ransom:Win32/Filecoder.RB!MSR) |
| Symptoms of Infection | Files can’t be opened, files are renamed with the “.loches” extension, ransom note displayed on the desktop |
| Damage | Files are encrypted and cannot be opened without payment. Other malware infections may also be installed alongside the ransomware. |
| Distribution Methods | Infected email attachments (macros), torrent websites, malicious ads, compromised websites, software vulnerabilities, P2P networks, infected USB drives |
| Danger Level | High. Files are permanently encrypted, and there is no guarantee that paying the ransom will lead to decryption. |
Remove
Loches Ransomware
With SpyHunter
Download SpyHunter now, and scan your computer for this and other cybersecurity threats for free!
Detailed Analysis of Loches Ransomware
Ransom Note Overview
The ransom note created by Loches is named "how_to_back_files.html." This file is placed on the victim’s desktop after the files are encrypted. The note contains a message from the attackers, informing the victim that their network has been compromised and that important files have been encrypted using RSA and AES encryption. The attackers claim to be the only ones who can decrypt the files and warn that using third-party software will result in permanent corruption of the encrypted files.
The note goes further to threaten the victim with data exposure if the ransom is not paid. The attackers claim to have stolen sensitive personal and confidential data, which will be released to the public or sold unless the victim complies with their demands. The ransom note also promises to decrypt 2-3 unimportant files for free as a demonstration of their capability to decrypt the files.
Here is the exact text of the ransom note:
YOUR PERSONAL ID:
-
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\
All your important files have been encrypted!
Your files are safe! Only modified. (RSA+AES)
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.
No software available on internet can help you. We are the only ones able to
solve your problem.
We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..
We only seek money and our goal is not to damage your reputation or prevent
your business from running.
You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.
Contact us for price and get decryption software.
email:
rudolfbrendlinkof1982@tutamail.com
robertokarlosonewtggg@outlook.com
* To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.Distribution Methods and Infection Vectors
Loches ransomware typically spreads through various means, including:
- Email Attachments: Malicious attachments in phishing emails are one of the most common ways that ransomware like Loches is distributed. These attachments often contain macros or malicious scripts designed to exploit vulnerabilities in software.
- Torrent Websites: The ransomware may also be bundled with pirated software or cracks available on torrent sites. Users downloading files from these sources are at a high risk of infection.
- Malicious Ads and Deceptive Websites: Cybercriminals use malicious ads (malvertising) on websites, tricking users into downloading the ransomware by clicking on infected ads.
- Exploiting Software Vulnerabilities: Attackers may exploit vulnerabilities in outdated software or operating systems to gain access to users' devices.
- USB Drives and P2P Networks: Infected USB drives or files shared over peer-to-peer (P2P) networks can also deliver the Loches ransomware to unsuspecting victims.
Damage Caused by Loches
The primary damage caused by Loches is the encryption of files, making them inaccessible without the decryption key. Victims may lose access to crucial documents, databases, and other important files. Additionally, attackers may install other malware, such as password-stealing trojans, which can further compromise the victim's security.
Furthermore, the attackers threaten to release sensitive data unless a ransom is paid, adding an additional layer of harm, especially for businesses and organizations.
Removal Guide: How to Remove Loches Ransomware
Remove
Loches Ransomware
With SpyHunter
Download SpyHunter now, and scan your computer for this and other cybersecurity threats for free!
Removing Loches ransomware involves several key steps to ensure that the infection is fully eradicated and that the system is secure.
- Disconnect the Infected Device: Immediately disconnect the infected computer from the network to prevent the ransomware from spreading to other devices.
- Run Antivirus or Anti-Malware Software: Use a reputable antivirus tool like SpyHunter to scan and remove the Loches ransomware from your device. Follow the software’s instructions to remove any detected threats.
- Manually Remove Ransomware Files: While antivirus tools can help remove the bulk of the infection, you may also need to manually delete any remaining ransomware files. Look for files with the ".loches" extension and delete them.
- Restore from Backup: If you have a backup of your encrypted files, restore them after the ransomware has been completely removed.
- Contact Professionals: If you’re unsure how to remove the ransomware or recover your files, consider contacting a professional cybersecurity service for assistance.
- Change Passwords: After the ransomware is removed, change all passwords, especially if the ransomware stole sensitive data.
Preventive Methods
To avoid future ransomware infections like Loches, consider the following preventive measures:
- Backup Regularly: Always maintain up-to-date backups of important files in a secure, offline location. This will help ensure that your data remains safe, even if you fall victim to a ransomware attack.
- Exercise Caution with Emails: Be wary of emails from unknown senders, especially those with attachments or links. Avoid clicking on suspicious links or downloading unknown files.
- Update Software and Systems: Regularly update your operating system and software to patch vulnerabilities that could be exploited by ransomware.
- Use Reliable Security Software: Install a comprehensive antivirus or anti-malware solution and keep it updated to protect against known threats like Loches.
- Avoid Pirated Software: Refrain from downloading pirated software, cracks, or tools from untrusted sources, as they are often bundled with malware.
- Disable Macros: Disable macros in Microsoft Office files unless absolutely necessary, as many ransomware variants use macros to execute their malicious payload.
Conclusion
Loches ransomware is a serious threat that can cause significant damage by encrypting files and demanding a ransom for decryption. While paying the ransom may seem like an easy solution, there’s no guarantee that the attackers will provide the decryption key. Following a thorough removal process and taking preventive steps can help protect your data and prevent future infections.
Remove
Loches Ransomware
With SpyHunter
Download SpyHunter now, and scan your computer for this and other cybersecurity threats for free!
