Duck Ransomware 🔐 (. Duck File) — Removal Guide

What is known about the Duckvirus?

The renaming will be done by the following pattern: id[xxxxxx].[contact_email].duck. In the course of encryption, a file entitled, for example, “report.docx” will be renamed to “report.docx.id[9ECFA84E-3316].[].duck”.

In every directory containing the encrypted files, a info.txt text file will appear. It is a ransom money note. It contains information about the ways of contacting the racketeers and some other remarks. The ransom note usually contains instructions on how to purchase the decryption tool from the tamperers. You can obtain this tool after contacting by email. That is how they do it.

The info.txt file accompanying the Duck malware states the following:

!!!All of your files are encrypted!!!
To decrypt them send e-mail to this address: 
In case of no answer in 24 hours write us to this e-mail:
Our online operator is available in the messenger Telegram: @supprecovery

In the screenshot below, you can see what a folder with files encrypted by the Duck looks like. Each filename has the “.duck” extension added to it.

How did my machine catch Duck ransomware?

Nowadays, there are three most exploited methods for malefactors to have ransomware working in your system. These are email spam, Trojan injection and peer-to-peer networks.

If you open your mailbox and see emails that look like familiar notifications from utility services providers, delivery agencies like FedEx, web-access providers, and whatnot, but whose sender is strange to you, be wary of opening those emails. They are most likely to have a ransomware file attached to them. So it is even more dangerous to download any attachments that come with letters like these.

Another thing the hackers might try is a Trojan horse scheme³. A Trojan is a program that gets into your computer pretending to be something different. For example, you download an installer for some program you need or an update for some software. But what is unpacked turns out to be a harmful agent that encodes your data. Since the installation package can have any name and any icon, you’d better be sure that you can trust the source of the stuff you’re downloading. The optimal way is to use the software developers’ official websites.

As for the peer networks like torrent trackers or eMule, the danger is that they are even more trust-based than the rest of the Web. You can never know what you download until you get it. So you’d better be using trustworthy websites. Also, it is reasonable to scan the folder containing the downloaded objects with the antivirus as soon as the downloading is finished.