OpJerusalem or JCry ransomware is a cryptovirus that attacked many popular Israeli websites on March 2nd, 2019, but soon was taken down by the cybersecurity experts. The attack was carried out by taking over the domain and trying to serve fake Adobe flash update, that was actually a ransomware installer. Fortunately, there was a mistake made in the code and thousands of potential victims simply ended up on a defacement page with big red letters ‘Jerusalem is the capital of Palestine #OpJerusalem’. Despite the failed attempts to proliferate, OpJerusalem ransomware itself works just fine and could have done a lot of damage to a number of Windows users.
Jcry Ransomware quicklinks
- What is JCry ransomware
- How does JCry virus spread
- How to remove JCry ransomware
- Automatic Malware removal tools
- How to recover JCry ransomware encrypted files and remove the virus
- Step 1. Restore system into last known good state using system restore
- 1. Reboot your computer to Safe Mode with Command Prompt:
- 2.Restore System files and settings.
- Step 4. Use Data Recovery programs to recover JCry ransomware encrypted files
(Win)
Note: Spyhunter trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions,
(Mac)
Note: Combo Cleaner trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions, Refund Policy ,
Malware experts managed to take a better look at this OpJerusalem virus and analyze its sample and what online users would have had to deal with if the crooks’ attack had gone just as planned. The demonstrated behavior disclosed very typical ransomware, just like Frendi, Borontok, PewCrypt, and did not surprise with unseen features or abilities. If you’d like to see the full JCry ransomware attack video, you can do it by visiting GrujaRS cybersecurity professional’s Twitter or read about the main features in this article. If somehow you managed to infect your System with JCry cryptovirus, at the end you’ll also find instructions on how to remove it.
What is JCry ransomware
As you know now from the introduction, JCry ransomware is a scandalous cryptovirus, which was planned to be spread as a fake Adobe Flash update via hundreds of infected Israeli websites and attack Windows OS users. Due to some mistake in the code, it shamefully never infected anyone nor caused any other harm, except for disturbing some websites’ operations for several hours, until it was removed. Despite the unsuccessful distribution, the threat itself is running properly and has all the typical characteristics specific to ransomware. It also is well recognized by antivirus engines, as the Virustotal.com scan shows.
If potential victims have opened that deceitful ‘flashplayer_install.exe’, that JCry ransomware developers were trying to distribute so badly, in a couple of moments they would have seen their computers compromised by the greedy virus that affects all personal files, including precious virtual memories and work, by locking them and marking with the ‘.jcry’ extension at the end of their names, moreover demanding for a payment of $500 in Bitcoin cryptocurrency in exchange for the decryptor. The locking cipher that OpJerusalem virus used is a Symmetric AES algorithm meaning that only hackers know the code which could make the data accessible again.
This strong algorithm and no official decryptor, allows JCry virus creators to demand a pretty high amount of money, which would come in a form of a pop-up and later .html note:
#OpJerusalem
[#] Jerusalem is the capital of Palestine [#]
If you are reading this, all your important files have been encrypted,
read JCRY_NOTE.html in your Desktop for more information.
[X] Enter Your Decryption Key:
JCRY_Note.html
All Your Important Files have been Encrypted
1- Send 500$ worth of Bitcoin to this Address : 1FKWhzAeNhsZ2JQuWjWsEeryR6TqLkKFUt
2- Download Tor Browser and Open the following Link : Recovery Link
3- Enter the Address used in Payement
4- We’ll check your Payement and upload your Decryption Key
5- Open the same link again (after a while) and enter your Unique ID to get your Decryption Key
Your Unique Key :
Unlike some other threats, JCry ransomware decided not to use any contact emails, but instead direct victims to their Tor Browser link where they dedicated a website that supposedly checks if you have paid and gives your decrypting key. It is however unknown whether hackers would bother to send you your unique Unlocking code because there were dozens of situations when the threat actors simply took the money and never replied back.
How does JCry virus spread
At the moment there is only one JCry virus distribution method that’s known to the public and it is throught the multiple infected Israeli websites. Luckily, they are all taken down, therefore the proliferation is ceased. The Bleepingcomputer.com reported, the hackers altered DNS record for a common plugin from nagich.com, which would allow anyone with disabilities to access all webpages, despite their design and etc. Threat actors manipulated the extension to launch the malicious code instead of an actual plugin, but due to a failed ‘if condition’, the code after initiation was never able to reach the download link, therefore the attack never loaded properly. More on failing attack by Ido Naor. Although this kind of JCry ransomware spreading is more elaborate than malspam, the mistake that saved thousands on users was rather silly.
How to remove JCry ransomware
Clearly, since the OpJerusalem virus was taken down pretty rapidly and because it was never able to successfully accomplish attacking Windows systems or anything at all, most likely you won’t even have to worry about this threat-caused consequences such as the encrypted files and etc. However, if for some reason JCry ransomware did find its way to your computer and your data is marked with .jcry extension, then you need to take action which consists of malware removal and data recovery from backups, as we demonstrate in the instructions below.
Ransomware elimination should be best performed with a special anti-malware software like Spyhunter. It is enough to just run a scan with these security tools and they will show all found dangerous files and provide you with further explanations on how to delete them, which is typically just pressing the button ‘Remove’. We highly suggest scanning your PC with the above-listed programs or any antivirus tool even if you weren’t infected by JCry ransomware since it will show the system is actually safe to use and there are no free viruses harming your Windows.
Automatic Malware removal tools
(Win)
Note: Spyhunter trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions,
(Mac)
Note: Combo Cleaner trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions, Refund Policy ,
How to recover JCry ransomware encrypted files and remove the virus
Step 1. Restore system into last known good state using system restore
1. Reboot your computer to Safe Mode with Command Prompt:
for Windows 7 / Vista/ XP
- Start → Shutdown → Restart → OK.
- Press F8 key repeatedly until Advanced Boot Options window appears.
- Choose Safe Mode with Command Prompt.
for Windows 8 / 10
- Press Power at Windows login screen. Then press and hold Shift key and click Restart.
- Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
- When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.
2.Restore System files and settings.
- When Command Prompt mode loads, enter cd restore and press Enter.
- Then enter rstrui.exe and press Enter again.
- Click “Next” in the windows that appeared.
- Select one of the Restore Points that are available before OpJerusalem has infiltrated to your system and then click “Next”.
- To start System restore click “Yes”.
Step 2. Complete removal of JCry ransomware
After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to OpJerusalem. You can check other tools here.Step 3. Restore JCry ransomware affected files using Shadow Volume Copies
If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually OpJerusalem tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.
b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.
Step 4. Use Data Recovery programs to recover JCry ransomware encrypted files
There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:- We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
- Download a data recovery program.
- Install and scan for recently deleted files.
