ALBABAT Virus 🔐 (.ABBT Files) — How to Remove?

The Albabat virus belongs with the ransomware type of infection. A harmful program of this type encrypts all user’s data on the computer (images, text files, excel tables, music, videos, etc) and adds its extra extension to every file, leaving the README.html files in each directory which contains the encrypted files.

Albabat virus: what is known so far?

Albabat will add its own .abbt extension to the name of every encoded file. For instance, an image named “photo.jpg” will be turned into “photo.jpg.abbt”. In the same manner, the Excel sheet with the name “table.xlsx” will become “table.xlsx.abbt”, and so forth.

In every directory with the encrypted files, a README.html file will be found. It is a ransom money memo. It contains information about the ways of paying the ransom and some other information. The ransom note most probably contains instructions on how to buy the decryption tool from the tamperers. You can obtain this decoding tool after contacting [email protected] via email. That is it.

Albabat Overview:

In the screenshot below, you can see what a folder with files encrypted by the Albabat looks like. Each filename has the “.abbt” extension added to it.

How did my computer get infected with Albabat ransomware?

There are plenty of possible ways of ransomware infiltration.

Nowadays, there are three most popular ways for hackers to have ransomware working in your system. These are email spam, Trojan injection and peer file transfer.

• Another option for ransom hunters is a Trojan horse model. A Trojan is an object that infiltrates into your computer disguised as something different. For example, you download an installer of some program you need or an update for some service. But what is unpacked turns out to be a harmful program that encodes your data. As the update file can have any name and any icon, you have to make sure that you can trust the resource of the things you’re downloading. The optimal way is to trust the software companies’ official websites.
• As for the peer file transfer protocols like torrent trackers or eMule, the threat is that they are even more trust-based than the rest of the Web. You can never guess what you download until you get it. Our suggestion is that you use trustworthy resources. Also, it is a good idea to scan the folder containing the downloaded files with the anti-malware utility as soon as the downloading is done.

How to remove ransomware?

It is crucial to inform you that besides encrypting your data, the Albabat virus will probably install Vidar Stealer on your PC to seize your credentials to various accounts (including cryptocurrency wallets). The mentioned spyware can extract your credentials from your browser’s auto-filling data.

How to avert ransomware infection?

Albabat ransomware doesn’t have a superpower, so as any similar malware.

You can defend your computer from its injection in three easy steps:

• Ignore any emails from unknown senders with unknown addresses, or with content that has likely no connection to something you are expecting (can you win in a lottery without participating in it?). In case the email subject is more or less something you are expecting, scrutinize all elements of the suspicious email with caution. A fake email will always contain mistakes.
• Do not use cracked or unknown software. Trojan viruses are often shared as an element of cracked products, possibly under the guise of “patch” to prevent the license check. Understandably, untrusted programs are very hard to tell from reliable software, as trojans may also have the functionality you need. Try to find information about this software product on the anti-malware forums, but the optimal solution is not to use such software.

FAQ

🤔 How can I open “.abbt” files?Can I somehow access “.abbt” files?

There’s no way to do it, unless the files “.abbt” files are decrypted.

🤔 The encrypted files are very important to me. How can I decrypt them quickly?

It’s good if you have fаr-sightedly saved copies of these important files elsewhere. Otherwise, you might try to employ System Restore. The only question is whether you have saved any Restore Points that would be helpful now. The rest of the methods require patience.

🤔 What to do if the Albabat virus has blocked my computer and I can’t get the activation key.

🤔 What can I do right now?

Some of the blocked files can be located elsewhere.

• If you exchanged your critical files by email, you could still download them from your online mailbox.
• You might have shared photographs or videos with your friends or family members. Simply ask them to give those images back to you.
• If you have initially downloaded any of your files from the Web, you can try doing it again.
• Your messengers, social networks pages, and cloud drives might have all those files as well.
• It might be that you still have the needed files on your old computer, a notebook, phone, memory stick, etc.

HINT: You can employ data recovery utilities¹ to retrieve your lost information since ransomware encrypts the copies of your files, removing the original ones. In the tutorial below, you can see how to recover your files with PhotoRec, but remember: you won’t be able to do it before you remove the virus with an antivirus program.

1. Here’s the list of Top 10 Data Recovery Software Of 2023.