SAURON Ransomware (@adm_helproot)

Malware analyst S!Ri was the one who originally recognized the Sauron virus, which falls under the ransomware type of malicious agent. Harmful software of such sort encrypts all user’s data on the computer (photos, text files, excel sheets, audio files, videos, etc) and adds its own extension to every file, creating the #HowToRecover.txt text files in every directory containing encrypted files.

Sauron virus: what is known so far?

The renaming will be executed according to this pattern: .Sauron. As a part of encryption, a file entitled, for instance, “report.docx” will be changed to “report.docx.[ID-35AEE360].[[email protected]].Sauron”.

In every folder that contains the encoded files, a #HowToRecover.txt file will be found. It is a ransom money note. It contains information about the ways of paying the ransom and some other information. The ransom note most probably contains instructions on how to buy the decryption tool from the racketeers. You can get this tool after contacting [email protected], @adm_helproot (Telegram) through email. That is it.

Sauron Overview:

The #HowToRecover.txt document accompanying the Sauron ransomware provides the following frustrating information:

Your Files Have Been Encrypted!
Attention!


All your important files have been stolen and encrypted by our advanced attack.
Without our special decryption software, there\'s no way to recover your data!


Your ID: [ - ]


To restore your files, reach out to us at: [email protected]
You can also contact us via Telegram: @adm_helproot


Failing to act may result in sensitive company data being leaked or sold.
Do NOT use third-party tools, as they may permanently damage your files.


Why Trust Us?


Before making any payment, you can send us few files for free decryption test.
Our business relies on fulfilling our promises.


How to Buy Bitcoin?


You can purchase Bitcoin to pay the ransom using these trusted platforms:


hxxps://www.kraken.com/learn/buy-bitcoin-btc
hxxps://www.coinbase.com/en-gb/how-to-buy/bitcoin
hxxps://paxful.com

In the screenshot below, you can see what a directory with files encrypted by the Sauron looks like. Each filename has the “.Sauron” extension appended to it.

How did Sauron ransomware end up on my PC?

There are plenty of possible ways of ransomware infiltration.

There are currently three most exploited ways for tamperers to have ransomware planted in your digital environment. These are email spam, Trojan introduction and peer networks.

• If you access your mailbox and see letters that look just like notifications from utility services companies, delivery agencies like FedEx, web-access providers, and whatnot, but whose addresser is strange to you, be wary of opening those letters. They are very likely to have a malicious item enclosed in them. Therefore, it is even more dangerous to download any attachments that come with emails like these.
• Another option for ransom hunters is a Trojan file scheme. A Trojan is a program that infiltrates into your computer disguised as something legal. For instance, you download an installer of some program you need or an update for some program. But what is unboxed turns out to be a harmful agent that compromises your data. Since the update wizard can have any title and any icon, you’d better be sure that you can trust the source of the stuff you’re downloading. The best thing is to use the software developers’ official websites.
• As for the peer networks like torrent trackers or eMule, the threat is that they are even more trust-based than the rest of the Internet. You can never guess what you download until you get it. So you’d better be using trustworthy resources. Also, it is reasonable to scan the directory containing the downloaded files with the antivirus as soon as the downloading is finished.

How do I get rid of ransomware?

It is important to note that besides encrypting your files, the Sauron virus will probably deploy Vidar Stealer on your machine to get access to credentials to various accounts (including cryptocurrency wallets). That spyware can extract your credentials from your browser’s auto-filling data.

How do I avert ransomware attack?

Sauron ransomware has no endless power, neither does any similar malware.

You can protect your computer from its injection within several easy steps:

• Ignore any letters from unknown mailboxes with unknown addresses, or with content that has nothing to do with something you are expecting (how can you win in a lottery without even taking part in it?). In case the email subject is likely something you are waiting for, check all elements of the dubious email carefully. A fake letter will always contain a mistake.
• Never use cracked or unknown programs. Trojan viruses are often distributed as a part of cracked products, possibly under the guise of “patch” which prevents the license check. But dubious programs are difficult to tell from reliable ones, because trojans may also have the functionality you need. Try searching for information on this software product on the anti-malware forums, but the optimal solution is not to use such software.

FAQ

🤔 Are the “.Sauron” files accessible?

Negative. That is why ransomware is so frustrating. Until you decode the “.Sauron” files you will not be able to access them.

🤔 I really need to decrypt those “.Sauron” files ASAP. How can I do that?

It’s good if you have fаr-sightedly saved copies of these important files elsewhere. In case you haven’t, there is still a chance that you do have a Restore Point from some time ago to roll back the whole system to the moment when it had no virus yet, but already had your files. The rest of the methods require patience.

🤔 What actions should I take if the Sauron ransomware has blocked my computer and I can’t get the activation key.

🤔 And what should I do now?

Many of the encrypted files might still be at your disposal

• If you exchanged your important files through email, you could still download them from your online mail server.
• You may have shared photographs or videos with your friends or relatives. Simply ask them to post those images back to you.
• If you have initially got any of your files from the Internet, you can try downloading them again.
• Your messengers, social media pages, and cloud disks might have all those files too.
• Maybe you still have the needed files on your old computer, a portable device, phone, external storage, etc.

HINT: You can use data recovery programs¹ to retrieve your lost information since ransomware arrests the copies of your files, deleting the original ones. In the tutorial below, you can learn how to recover your files with PhotoRec, but remember: you won’t be able to do it before you remove the ransomware itself with an anti-malware program.

1. Here are Top 10 Data Recovery Software Of 2024.