Geek's Advice

LALO ransomware appears as the 220th version of DJVU virus

LALO ransomware is the name of a new crypto-virus originating from DJVU ransomware group. It is a malicious and threatening computer virus made to encrypt files on target system using asymmetric encryption algorithm, mark them with .lalo file extensions and leave ransom-demanding _readme.txt notes behind. According to the ransom note, the cybercriminals want the victim to contact them within 3 days via provided emails and pay the ransom specified ($490) or the ransom price doubles to $980 afterwards. The aim of this malicious program is to keep the victim from its own files and force one to pay a ransom in exchange for data decryption tool and private key.

LALO ransomware is similar to previous DJVU versions including MPAJ, JOPE or MADO. It infects computers in a form of a software crack or keygen and runs its malicious file-encrypting processes in the background. In addition, it might display a fake Windows update screen for the victim. The virus scans entire system for target files, bypassing system folders only. This is done in order to keep the computer functioning properly.

While encrypting data, the ransomware also leaves _readme.txt notes in each folder that contains affected data. The note includes a message from cybercriminals, who shortly explain what happened, and what victim’s next actions should be if he/she wants to recover encrypted .lalo file type data ever again.

What is even worse, the described ransomware drags AZOrult malware into the infected host, causing a theft of all saved passwords and other sensitive data. The said password-stealing Trojan is known to be distributed along new versions of STOP/DJVU.

That said, we strongly recommend you to remove LALO ransomware virus using instructions provided below. If you want to speed up malware removal and system cleanse procedure, we encourage you to try System Mechanic Ultimate Defense, which is an excellent anti-malware and system mainentance software.

Threat Summary

Name	LALO ransomware virus
Type	Ransomware; file-encrypting malware
Version	220th version of STOP/DJVU
Ransom note	_readme.txt
Ransom price	$490 or $980
Extension	.lalo file extension
Detection names	Win/malicious_confidence_100% (W), A Variant Of Win32/Kryptik.HCSI, Trojan-Ransom.Win32.Stop.mh and others (full list on VirusTotal)
Symptoms	The victim discovers that all files have .lalo file type and can no longer be opened. Each folder that holds encrypted data has _readme.txt note on it, including cybercriminals’ instructions on how to contact them and pay a ransom of $490 (if paid within 3 days) or $980.
Contact emails	helpdatarestore@firemail.cc (primary email), helpmanager@mail.ch (secondary)
Associated processes	B236.tmp.exe
Distribution	Arrives along software cracks, KMSPico, keygens
Removal	We recommend automatic ransomware removal using System Mechanic Ultimate Defense which also includes a data recovery component.
Post-removal steps	Recover files from data backups and change all of your passwords

Ransom note explains – pay or forget your files

The _readme.txt text file created by LALO extension virus states that the victim shouldn’t worry as there is hope to return all of victim’s files. The note briefly explains that files have been encrypted with “strongest encryption and unique key.” Thus, the process can be reverted only by having a private decryption key and decryption software. These tools are kept by cybercriminals in their servers, and cannot be accessed, calculated, or obtained in any way than paying the ransom.

The attackers promise to prove the existence of such tools for victims who are not convinced by the explanation itself. The ransomware creators advise sending one small encrypted .lalo file to them and promise to respond with an attached decrypted version of the file.

The criminals provide two emails so that the victim can contact them – helpmanager@mail.ch and helpdatarestore@firemail.cc. Before contacting them, keep in mind that there are no guarantees they will actually restore your files, even if you pay the required ransom amount.

Full contents of the ransom note:

ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
[removed link]
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
helpdatarestore@firemail.cc
Reserve e-mail address to contact us:
helpmanager@mail.ch
Your personal ID:

Ransomware prevents access to popular cyber security websites

Attempts to search for ransomware-related information online might also be unsuccessful, since LALO virus modifies Windows hosts file and blocks access to sites like Microsoft and others. This is done in order to prevent the victim from seeking help, cause frustration and convince to pay the ransom sooner.

What can be done to decrypt .lalo files?

The most important question for each victim of the discussed ransomware is how to decrypt files affected by LALO file virus. There is no easy answer to this, but there is one case in which you might succeed to recover your files.

In order to understand your chances to restore encrypted data, you must familiarize yourself with the way this virus functions. It encrypts victim’s computer either with online key (if it successfully connects to its remote Command&Control server and gets the key from there) or uses a hardcoded offline encryption key that comes with the virus code itself. At this point, it is imporant to understand that offline key is one and only, and anyone affected with the same key can decrypt their files with the same decryption key, too.

In simple terms, if your files were affected with the offline encryption, you will be able to decrypt .lalo files if someone else also affected by the same encryption will pay the ransom and share the decryption key with cybersecurity specialists. At the moment, the decryption for this specific ransomware is unavailable, but we strongly encourage you to check for updates here: How to Decrypt Files Locked by STOP/DJVU, which also explains how to identify which encryption type was used on your computer.

Malware distribution explained

Like the majority of malicious software, LALO ransomware virus leverages computer user’s curiosity and tendency not to pay for software licenses. That said, most DJVU victims find a version of the ransomware in software cracks they download. In addition, you might come accross this malware if you download tools like KMSPico. This also includes other software activation tools that are illegal, for instance, key generators. Therefore, if you find yourself searching for Adobe Photoshop or game crack, prepare yourself for a surprise that restricts access to your personal files until you pay up.

While STOP/DJVU is the most prevalent ransom-demanding malware at the moment, there are other viruses such as PHOBOS, NEMTY or SODINOKIBI. These viruses employ slightly different attack methods. For example, you might accidentally visit a website that includes an exploit kit, or you might open an email containing a malicious attachment. Therefore, it is important to follow ransomware prevention practices to keep your data safe.

Remove LALO ransomware virus safely

When it comes to LALO ransomware removal, focus on instructions prepared by qualified cybersecurity specialists. They explain how to boot your PC in Safe Mode, which will prevent any malware from interfering with security programs.

While theoretically you can delete malware manually, you must be an expert in malware analysis to do it yourself. Therefore, we recommend leaving this task for anti-malware programs like System Mechanic Ultimate Defense. We strongly recommend this software due to its capabilities to cleanse virus damage and improve overall computer’s security status. Use it to remove LALO ransomware virus and AZORULT malware for good.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Alternative software recommendations

Malwarebytes Anti-Malware

Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense

If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.