Home Malware Programs Ransomware 'Alex.vlasov@aol.com' Ransomware

'Alex.vlasov@aol.com' Ransomware

Posted: July 21, 2016

Threat Metric

Threat Level: 10/10
Infected PCs: 162
First Seen: July 21, 2016
Last Seen: August 17, 2022
OS(es) Affected: Windows


The 'alex.vlasov@aol.com' Ransomware is a member of the Troldesh Ransomware family. Members of this family display ransom messages for your data while also encrypting your files. Malware experts recommend using preemptive data backup strategies to protect yourself in these attacks, along with anti-malware applications that can delete the 'alex.vlasov@aol.com' Ransomware and assist with your PC's recovery.

A New Road to Digital Ransoms

The Troldesh Ransomware is a threat whose campaign was under analysis in the early half of 2015, with its attacks showing signature characteristics such as heavily relying on e-mail address-based ransom methods. Since then, con artists have been generating new variants of the Trojan, all of which share its central design elements. These spinoffs consist of previously-analyzed threats like the Bitcoinrush Ransomware or the Vegclass@aol.com Ransomware, as well as the new the 'alex.vlasov@aol.com' Ransomware.

The 'alex.vlasov@aol.com' Ransomware attacks your files by two means, one of which is intended to block you from accessing them, while the other one lets you identify the affected content:

  • The 'alex.vlasov@aol.com' Ransomware uses an AES-based encryption algorithm for restructuring the data of each file it attacks. Although this attack is, in theory, reversible, no free Troldesh decryptors exist currently. Encrypted files can't be read by their associated applications until another application decrypts them, which requires a key that's unique to each infection.
  • The 'alex.vlasov@aol.com' Ransomware also renames your files by adding on the 'XTBL' extension, its administrator's e-mail address, and a unique ID number. Note that the 'alex.vlasov@aol.com' Ransomware and even the Troldesh Ransomware variants are not the only threats of this type to use the 'XTBL' extension.

With its encryption attack concluded, the 'alex.vlasov@aol.com' Ransomware generates text and image-based extortion messages on your PC. These messages may contain limited additional content, besides re-emphasizing that victims should contact the Trojan's e-mail on how to pay to get their data back.

Swerving Off the Map of the the 'alex.vlasov@aol.com' Ransomware Campaign

Many families of threatening data encryptors have been 'cracked' by PC security researchers, allowing a victim to download free decryptors for simple data restoration. However, decryption never is a guarantee, and the 'alex.vlasov@aol.com' Ransomware does not have any known freeware decryptor that would let you reverse the Trojan's attacks without paying the ransom. With new threats like the 'alex.vlasov@aol.com' Ransomware being a regular part of the 2016's threat landscape, malware analysts heavily stress the strength of standardized backup protocols that can let you restore content without needing a decryptor.

The specificity of the 'alex.vlasov@aol.com' Ransomware's symptoms bundles itself with other traits shared between many variants of the Troldesh Ransomware, such as its use of a highway-themed extortion picture. No matter what variant of this threat infects your PC, you should prioritize restoring the system's security before trying to recover any damaged content. Qualified anti-malware programs, if not blocked, should be able to delete the 'alex.vlasov@aol.com' Ransomware and prevent it from encrypting any other files.

Desperate PC owners even may consider paying the ransom the 'alex.vlasov@aol.com' Ransomware's author asks for in return for a decryptor. However, since such exchanges come with no legal backing naturally, malware experts still suggest keeping your information safely out of a Trojan's reach entirely.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload18.exe File name: Payload18.exe
Size: 247.59 KB (247599 bytes)
MD5: 55ce2d19629b55950d550feec3da04f6
Detection count: 70
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: August 17, 2022
%SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload08.exe File name: Payload08.exe
Size: 248.83 KB (248832 bytes)
MD5: d371b702161c64a6dc29c8fe46dcb19c
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: August 24, 2016
%SystemDrive%\Users\<username>\Downloads\Payload_c.exe File name: Payload_c.exe
Size: 250.67 KB (250674 bytes)
MD5: 03b502d2de91bc1e8dd8bc967074938b
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\Downloads
Group: Malware file
Last Updated: August 24, 2016
Loading...