Do you know what Noblis Ransomware is?
Recently our computer security specialists obtained a sample of a still unfinished file-encrypting application titled Noblis Ransomware. Therefore, it is highly unlikely the threat is being distributed. However, once the cyber criminals who created it finish the malicious application we have no doubt they will start distributing it right away. In which case, we believe the malware might be spread only among Spanish-speaking users since currently, it drops a ransom note written just in Spanish. If you would like to know how Noblis Ransomware works or what harm it could cause you, when it gets fully developed; we invite to read the rest of our report. At the end of it we will add a removal guide showing how one could erase the malicious application manually; just keep it in mind the finished version could work a bit differently and accordingly it is quite possible the given steps may not help with the threat’s deletion. This is why it might be best to eliminate it with a reputable antimalware tool.
As in many cases, Noblis Ransomware got its name from the additional extension it appends to its encrypted files, e.g., picture.jpg.noblis. Researchers think it is still just in the development stage because the malware does not give a real Bitcoin wallet address to transfer the ransom. Not to mention the asked sum is ridiculously large. The hackers claim the user has to pay 1 Bitcoin; it might not seem like a huge sum if you do not know how much it is worth, but if you convert it to US dollars at the moment of writing you get approximately $17.000.
Naturally, photos and other precious mementos are priceless to most of us, but we doubt there would be a lot of users willing to risk such an amount of money just to get their data back. Once the malicious application is finished the price would most likely become more reasonable, e.g., it could drop to a couple of hundreds or even less than $100. Of course, even so, we advise against paying the ransom as there is always a chance something may go wrong, and you could end up with no files and smaller savings.
Noblis Ransomware screenshot
Scroll down for full removal instructions
Another thing we learned while testing the malware is that it encrypts user’s data with a strong cryptosystem known as AES-256. Noblis Ransomware can encrypt images, photos, text or other documents, videos, music files, and so on. Then the threat should open a window with a message or in other words a ransom note. It should say “YOUR FILES HAVE BEEN ENCRYPTED!” and then display a text written in Spanish. The message says the user can decrypt his files only with a unique decryption key located on a secret server and to obtain it he is supposed to pay a ransom. The threat’s creators even give a time limit of just 24 hours.
Furthermore, it is important to mention the in development Noblis Ransomware’s version allows to close its window just by clicking the X button, but in the later versions, it could be difficult to get rid of the malicious application’s window. Thus, the removal guide below the article will show you how to kill the malware’s process via Task Manager as it should close the mentioned window automatically. Afterward, it is important to erase the file that infected the system, e.g., it could be a malicious email attachment, fake software installer, and so on. The rest of the instructions will show where to look for the malware’s launcher and how to delete it, but if the process seems a bit too complicated we recommend using an antimalware tool instead.
Eliminate Noblis Ransomware
- Click Ctrl+Alt+Delete simultaneously.
- Pick Task Manager.
- Take a look at the Processes tab.
- Locate a process belonging to the malicious program.
- Select this process and press the End Task button.
- Click Windows Key+E.
- Navigate to the suggested paths:
%TEMP%
%USERPROFILE%Desktop
%USERPROFILE%Downloads - Search for a file that was launched when the system got infected.
- Right-click the malicious file and select Delete.
- Leave File Explorer.
- Restart the computer.
In non-techie terms:
Noblis Ransomware is a malicious application that is still in the development stage. In other words, it may not be distributed yet. Nonetheless, if it begins to spread it might cause users who infect their system with it quite a lot of trouble since the malware is capable of encrypting various files. In which case, the user would be most likely asked to pay a particular sum for a decryption tool. Given there are cases when users get tricked, we do no advise paying the ransom, especially if the sum is not something you could easily just throw away. Instead, users should make sure they have copies of their most important data so that in case of an emergency they would be able to recover it, e.g., you could backup your files on cloud storage, removable media devices, and so on. Another good idea might be to invest in a reputable antimalware tool as it could help you guard the system against ransomware and other harmful threats.