Do you know what Sarut Ransomware is?
Sarut Ransomware is a malicious program from the STOP Ransomware family. With this group of infections, we have a silver lining because there is a public decryption tool available. Please bear in mind that it might not be possible to restore every single file affected by this program because it only works on files that were encrypted with the offline key, but you can still try to apply it. Needless to say, you need to remove Sarut Ransomware as well. For that, you can find the manual removal instructions at the bottom of this description.
As mentioned, this program belongs to the STOP Ransomware family. Therefore, it is bound to be similar to Rezm Ransomware, Topi Ransomware, Npsg Ransomware, and many other programs that were all based on the same code. At the same time, we can assume that those programs use the same distribution methods. If that is the case, users must download the installer file for Sarut Ransomware themselves. Of course, they don’t do it on purpose, but they are not aware of the ransomware distribution patterns, and thus, they fall into that trap.
What are the usual ransomware distribution vectors? For the most part, ransomware programs travel via spam email attachments. They can also reach us through illegal downloads. For example, if you download a pirated program, it would be quite possible for Sarut Ransomware to be part of the “setup,” too. Therefore, we have to be very careful when we download and install new applications. Do not use pirated software. It’s not just about stealing from the creators, you might as well get infected with malware, too.
Also, spam email attachments remain an important ransomware distribution method. These attached files often look like important documents that you have to open immediately. The messages that they come with try to adopt an urgent tone, and this tone should push the user into downloading and opening the file immediately. However, before you open such files (especially if you receive them from unknown senders), you should definitely scan them with a licensed security tool. Otherwise, you might be just a click away from a severe ransomware infection.
Sarut Ransomware screenshot
Scroll down for full removal instructions
On the other hand, what happens if Sarut Ransomware enters your system? Well, then the infection runs a full system scan because it needs to find all the files it can encrypt. You can be sure that all of your personal files will be affected by this encryption. When the encryption is complete, Sarut Ransomware will also add the extension to the affected files. The extension is “.sarut.” This is something that all ransomware infections do because those extensions are like stamps. They tell you which program affected your files, but of course, that is not exactly useful to you.
Sarut Ransomware also displays a ransom note. The ransom note in the TXT format file is dropped in the C:\ directory, and here’s an extract from it:
ATTENTION!
Don’t worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
<…>
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
The truth is that this ransom note text is the same across all STOP Ransomware infections. It means that these programs are released like off a conveyor belt, and all of them are quite similar. That is perhaps why have a decryption tool that can restore SOME of the files.
Please note that files affected by an online encryption key will not be decrypted. Therefore, the best way to restore your files is to transfer them back to your computer from a file backup. You will be able to do that if you regularly store your files in an external hard drive or in a cloud drive. However, if you do not have such storage, you should address a professional technician who will help you go through other possible file recovery options. Just make sure you do not get infected with the likes of Sarut Ransomware again!
How to Remove Sarut Ransomware
- Remove the most recently downloaded files.
- Delete the PersonalID.txt file dropped in the C:\ directory.
- Press Win+R and type %LOCALAPPDATA%. Click OK.
- Delete a folder with a long random name.
- Run a full system scan with the SpyHunter free scanner.
In non-techie terms:
Sarut Ransomware is a dangerous computer infection that wants to steal your money. It holds your files hostage and tells you that you have to pay the ransom fee if you want them back. There is a public decryption tool available that should restore some of your files, but please look for other file recovery options, too. Remove Sarut Ransomware and everything associated with it from your system as soon as possible. If you can, invest in a powerful antispyware program that will help you protect your system from harm.