Geek's Advice

Smpl ransomware is another new Dharma virus family member

Smpl ransomware is a file-encrypting virus that is categorized as one of the latest variants of the Dharma ransomware family. It marks corrupted files with the following pattern of extensions: original filename, unique victim’s ID, contact e-mail address, and .Smpl extension. People whose computers are infected receive instructions on how to decrypt affected data in FILES ENCRYPTED.txt file that serves as a ransom note. Victims who want to purchase the decryption tool are demanded to contact the attackers by writing to crimecrypt@aol.com or crimecrypt@airmail.cc e-mails.

Developers of the malware use both, symmetric and asymmetric encryption algorithms to lock the most important information on the computer. Later, victims see a pop-up window that displays the ransom note. Cybercriminals explain that users cannot access any of the encoded files and the only way to get them back is to buy a decryption key. The amount of the ransom demanded is not specified immediately. Although, according to the research of similar infections, it can range from several hundred up to a thousand US dollars.

The crooks ask people not to worry as they can restore affected data. They ask to reach out to them right away by sending an e-mail letter to crimecrypt@aol.com address and include their unique victim ID. If they do not respond within 12 hours, users are asked to send another e-mail to crimecrypt@airmail.cc address. Following the instructions, victims are promised to receive the necessary information to make the ransom transaction and get Smpl decryptor right after the payment.

Once the attackers explain what happened to the locked data and specified what to do after, they include a paragraph named “Attention”. In that section, they specify that there are certain prohibitions in order for the ransom-decryption exchange to be successful. Victims are demanded not to rename the encrypted files and not to try using third-party decryption tools. Crooks indicate that it might force them to double the price of their decryptor, lure users into further scams, or cause permanent data loss.

Cybercriminals are highly unreliable

Our experience with ransomware-type infections contradicts these arguments as the developers of malware are usually unfair ones. We have encountered numerous cases where they disappear after receiving the payment or keep increasing the price of the decryption keys once they see that the victim agrees to pay up. Therefore, we strongly suggest you not to contact the attackers as there is a high risk that you will only suffer from financial losses.

In fact, many ransomware victims successfully restore encrypted data by using backup copies from the Cloud. If you store backups on the offsite storage device that has not been connected to your computer during the attack, those copies are not encrypted and can be safely used. Additionally, previous Dharma virus versions can be decrypted with Rakhni Decryptor by Kaspersky Lab (usage guide) or Trend Micro Ransomware Decryptor (usage guidelines). Thus, there is a strong chance that the new decryption software for the latest variants might soon be developed.

You can safely remove Smpl ransomware virus from Windows operating system by downloading and installing reputable antivirus software. Our security team also suggests using RESTORO for after-Smpl removal as it can help you to restore virus damage. Once you complete the elimination, you can further proceed to restore encrypted files. More information on how to start ransomware uninstall can be found at the end of this article.

Name	Smpl ransomware
Type	File locker, Crypto-malware, File-encrypting virus
Family	Dharma
Other variants	GYGA, FELIX, etc
Extension	.Smpl
Ransom note	FILES ENCRYPTED.txt
E-mails	crimecrypt@aol.com, crimecrypt@airmail.cc
Amount of the ransom	Unspecified
Symptoms	After the infiltration, it starts the data encryption process; Later, files marked with .Smpl extension can no longer be accessible for regular use
Distribution	Malicious ads, spam e-mails, and illegal downloads
Decryption	Files encrypted by this virus variant can only be restored by using backup copies from the Cloud
Elimination	The safest method to uninstall ransomware is to use reputable anti-malware or AV software. Afterwards, scan with RESTORO to repair virus damage

Explaining distribution tactics

Developers of malicious programs try to invent ways how unsuspecting computer users would download ransomware executables on their systems without even knowing. Likewise, one of the most popular methods to spread file-encrypting viruses is to post their files disguised as legitimate software cracks on illegal file-sharing websites. People are unable to check whether the file is an actual crack or ransomware. Thus, they download it and infiltrate their systems with crypto-malware on their own.

Furthermore, many crooks purchase millions of e-mail addresses on the darknet and create malicious spam e-mail campaigns. In other terms, they design electronic letters to look like invitations to update details via the appended link that supposedly comes from the bank or other legit institution. If users do not inspect the message, they click on the link recklessly and start the automatic installation of malware.

Finally, those who tend to browse on suspicious pages should be aware of malicious ads. Various questionable pages promote unverified ads that are in fact used to self-start the installation of ransomware once clicked. Therefore, people should not only refrain from browsing on questionable websites but also stop clicking on advertisements that pop up.

Smpl virus removal instructions

It is evident that ransomware viruses are the most dangerous ones that a regular computer user can encounter. They are highly complex programs that are designed to download and drop numerous different components for successful encryption. Some of them might even modify Windows hosts file to disrupt the connection to the security websites. Thus, Smpl virus removal is also a very complicated procedure that requires professional skills.

If you want to remove Smpl ransomware virus on your own and without in-person IT service help, you should start searching for professional malware removal tools. Our team recommends using RESTORO for after-removal damage repair. It has a very simple user interface that requires you to only click on the scan button to start the elimination procedure.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Alternative software recommendations

Malwarebytes Anti-Malware

Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense

If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.