Kirk Ransomware – Remove It and Restore .Kirked Files

Kirk Ransomware – Remove It and Restore .Kirked Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

This article will help you remove Kirk ransomware effectively. Follow the ransomware removal instructions at the bottom of the article.

Kirk is now the name of a ransomware cryptovirus and not only the name of the emblematic character from the Star Trek franchise. The virus is written in Python and it is the first one that demands payment in the Monero cryptocurrency. AES and RSA are the two encryption algorithms used by the Kirk ransomware to encrypt your files. The ransom note has ANSI elements and is very detailed in its instructions for payment. Keep on reading below to see how you could try to potentially restore some of your data.

Threat Summary

Short DescriptionThe ransomware encrypts files on your computer and demands payment for unlocking them.
SymptomsThe ransomware will encrypt your files while placing the extension .kirked after it completes its encryption process.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Kirk


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Kirk.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Kirk Ransomware – Infection

Kirk ransomware could spread its infection via different methods. The payload file that initiates the malicious script for this ransomware, which in turn infects your computer machine, is circling the Internet and a malware sample has been found by malware researchers. You can see the VirusTotal detections for different security programs of that sample by checking the screenshot below:

Kirk ransomware could also deliver its payload file on social media websites and networks for file-sharing. Freeware that is found on the Web could be presented as useful but at the same time could hide the malicious script for the cryptovirus. Refrain from opening files just as you have downloaded them, especially if they come from suspicious sources such as links or e-mails. Instead, you should scan them beforehand with a security tool, while also checking the size and signatures of these files for anything that seems out of the ordinary. You should read the ransomware prevention tips from the forum section.

Kirk Ransomware – Details

Kirk ransomware a cryptovirus which is written in the Python programming language. The ransomware gets its name from one of the most iconic characters of the Star Trek franchise – Captain James T. Kirk. Your files will get encrypted with a custom-made extension, that is .kirked, while preserving the original names of files.

Kirk ransomware could make entries in the Windows Registry to achieve persistence, launch and repress processes in Windows. Some entries are designed in a way that will start the virus automatically with each launch of the Windows Operating System, like the example one given right here:


The ransom note will be displayed inside a window after the encryption process is complete. That note is very detailed and long and even contains some ANSI images and text based around Star Trek. The note is contained inside a file called RANSOM_NOTE.txt. You can view part of the window of the ransom note message that loads in a window after file encryption completes right down here:

That ransom note reads the following:

Oh no! The Kirk ransomware has encrypted your files!

Your computer has fallen victim to the Kirk malware and important files have been encrypted – locked up so they don’t work. This may have broken some software, including games, office suites etc. Here’s a list of some the file extensions that were targetted: .3g2 … .pptm .mpk .re4

There are an additional 441 file extensions that are targetted. They are mostly to do with games. To get your files back, you need to pay. Now. Payments recieved more than 48 hours after the time of infection will be charged double. Further time penalties are listed below. The time of infection has been logged. Any files with the extensions listed above will now have the extra extension ‘.kirked’, these files are encrypted using military grade encryption. In the place you ran this program from, you should find a note (named RANSOM_NOTE.txt) similar to this one. You will also find a file named ‘pwd’ – this is your encrypted password file. Although it was generated by your computer, you have no way of ever decrypting it. This is due to the security of both the way it was generated and the way it was encrypted. Your files were encrypted using this password.

“Logic, motherfucker.” ~ Spock. Decrypting your files is easy. Take a deep breath and follow the steps below.

1 ) Make the proper payment. Payments are made in Monero. This is a crypto-currency, like bitcoin. You can buy Monero, and send it, from the same places you can any other crypto-currency. If you’re still unsure, google ‘bitcoin exchange’. Sign up at one of these exchange sites and send the payment to the address below. Make note of the payment / transaction ID, or make one up if you have the option. Payment Address (Monero Wallet): 4AqSwfTexbNaHcn8giSJw3KPiWYHGBaCF9bdgPxvHbd5A8Q3Fc7n6FQCReEns8uEg8jUo4BeB79rwf4XSfQPVL1SKdVp2jz

Prices: Days : Monero : Offer Expires 0-2 : 50 : 03/18/17 15:32:14 3-7 : 100 : 03/23/17 15:32:14 8-14 : 200 : 03/30/17 15:32:14 15-30 : 500 : 04/15/17 15:32:14 Note: In 31 days your password decryption key gets permanently deleted. You then have no way to ever retrieve your files. So pay now.

2 ) Email us. Send your pwd file as an email attachment to one of the email addresses below. Include the payment ID from step 1. Active email addresses: [email protected] [email protected]

3 ) Decrypt your files. You will recieve your decrypted password file and a program called ‘Spock’. Download these both to the same place and run Spock. Spock reads in your decrypted password file and uses it to decrypt all of the affected files on your computer. > IMPORTANT ! The password is unique to this infection. Using an old password or one from another machine will result in corrupted files. Corrupted files cannot be retrieved. Don’t fuck around.

4 ) Breathe.

Beneath this sentence you will see an image with the part that introduces the Monero cryptocurrency for the first time as a payment method, and the only available payment method at that:

The note of the Kirk ransomware states that your files are encrypted and to get them back you have to pay in Monero. You should NOT in any circumstance pay these cybercriminals. Your files may not get restored, and nobody could give you a guarantee for that. Furthermore, giving money to these criminals will likely motivate them to create more ransomware or do other criminal activities.

Kirk Ransomware – Encryption Process

The whole encryption process begins with the following notification pop-up:

The text from the notification has the same title as the network stress tool “LOIC”, which is:

Low Orbital Ion Cannon | When harpoons, air strikes and nukes fail | v1.0.1.0

After that message your computer system will be inspected and all files with extensions that the Kirk ransomware seeks to encrypt will become encrypted. That will happen with the help of the AES and RSA encryption algorithms.

Files that have extensions from the following list (around 625 different extensions) will become locked:

→.cfr, .ytd, .sngw, .tst, .skudef, .dem, .sims3pack, .hbr, .hkx, .rgt, .ggpk, .ttarch2, .hogg, .spv, .bm2, .lua, .dff, .save, .rgssad, .scm, .aud, .rxdata, .mcmeta, .bin, .mpqe, .rez, .xbe, .grle, .bf, .iwd, .vpp_pc, .scb, .naz, .m2, .xpk, .sabs, .nfs13save, .gro, .emi, .wad, .15, .vfs, .drs, .taf, .m4s, .player, .umv, .sgm, .ntl, .esm, .qvm, .arch00, .tir, .bk, .sabl, .bin, .opk, .vfs0, .xp3, .tobj, .rcf, .sga, .esf, .rpack, .DayZProfile, .qsv, .gam, .bndl, .u2car, .psk, .gob, .lrf, .lts, .iqm, .i3d, .acm, .SC2Replay, .xfbin, .db0, .fsh, .dsb, .cry, .osr, .gcv, .blk, .4, .lzc, .umod, .w3x, .mwm, .crf, .tad, .pbn, .14, .ppe, .ydc, .fmf, .swe, .nfs11save, .tgx, .trf, .atlas, .20, .game, .rw, .rvproj2, .sc1, .ed, .lsd, .pkz, .rim, .bff, .gct, .9, .fpk, .pk3, .osf, .bns, .cas, .lfl, .rbz, .sex, .mrm, .mca, .hsv, .vpt, .pff, .i3chr, .tor, .01, .utx, .kf, .dzip, .fxcb, .modpak, .ydr, .frd, .bmd, .vpp, .gcm, .frw, .baf, .edf, .w3g, .mtf, .tfc, .lpr, .pk2, .cs2, .fps, .osz, .lnc, .jpz, .tinyid, .ebm, .i3exec, .ert, .sv4, .cbf, .oppc, .enc, .rmv, .mta, .otd, .pk7, .gm, .cdp, .cmg, .ubi, .hpk, .plr, .mis, .ids, .replay_last_battle, .z2f, .map, .ut4mod, .dm_1, .p3d, .tre, .package, .streamed, .l2r, .xbf, .wep, .evd, .dxt, .bba, .profile, .vmt, .rpf, .ucs, .lab, .cow, .ibf, .tew, .bix, .uhtm, .txd, .jam, .ugd, .13, .dc6, .vdk, .bar, .cvm, .wso, .xxx, .zar, .anm, .6, .ant, .ctp, .sv5, .dnf, .he0, .mve, .emz, .e4mod, .gxt, .bag, .arz, .tbi, .itp, .i3animpack, .vtf, .afl, .ncs, .gaf, .ccw, .tsr, .bank, .lec, .pk4, .psv, .los, .civ5save, .rlv, .nh, .sco, .ims, .epc, .rgm, .res, .wld, .sve, .db1, .dazip, .vcm, .rvm, .eur, .me2headmorph, .azp, .ags, .12, .slh, .cha, .wowsreplay, .dor, .ibi, .bnd, .zse, .ddsx, .mcworld, .intr, .vdf, .mtr, .addr, .blp, .mlx, .d2i, .21, .tlk, .gm1, .n2pk, .ekx, .tas, .rav, .ttg, .spawn, .osu, .oac, .bod, .dcz, .mgx, .wowpreplay, .fuk, .kto, .fda, .vob, .ahc, .rrs, .ala, .mao, .udk, .jit, .25, .swar, .nav, .bot, .jdf, .32, .mul, .szs, .gax, .xmg, .udm, .zdk, .dcc, .blb, .wxd, .isb, .pt2, .utc, .card, .lug, .JQ3SaveGame, .osk, .nut, .unity, .cme, .elu, .db7, .hlk, .ds1, .wx, .bsm, .w3z, .itm, .clz, .zfs, .3do, .pac, .dbi, .alo, .gla, .yrm, .fomod, .ees, .erp, .dl, .bmd, .pud, .ibt, .24, .wai, .sww, .opq, .gtf, .bnt, .ngn, .tit, .wf, .bnk, .ttz, .nif, .ghb, .la0, .bun, .11, .icd, .z3, .djs, .mog, .2da, .imc, .sgh, .db9, .42, .vis, .whd, .pcc, .43, .ldw, .age3yrec, .pcpack, .ddt, .cok, .xcr, .bsp, .yaf, .swd, .tfil, .lsd, .blorb, .unr, .mob, .fos, .cem, .material, .lfd, .hmi, .md4, .dog, .256, .eix, .oob, .cpx, .cdata, .hak, .phz, .stormreplay, .lrn, .spidersolitairesave-ms, .anm, .til, .lta, .sims2pack, .md2, .pkx, .sns, .pat, .tdf, .cm, .mine, .rbn, .uc, .asg, .raf, .myp, .mys, .tex, .cpn, .flmod, .model, .sfar, .fbrb, .sav2, .lmg, .tbc, .xpd, .bundledmesh, .bmg, .18, .gsc, .shader_bundle, .drl, .world, .rwd, .rwv, .rda, .3g2, .3gp, .asf, .asx, .avi, .flv, .ai, .m2ts, .mkv, .mov, .mp4, .mpg, .mpeg, .mpeg4, .rm, .swf, .vob, .wmv, .doc, .docx, .pdf, .rar, .jpg, .jpeg, .png, .tiff, .zip, .7z, .dif.z, .exe, .tar.gz, .tar, .mp3, .sh, .c, .cpp, .h, .mov, .gif, .txt, .py, .pyc, .jar, .csv, .psd, .wav, .ogg, .wma, .aif, .mpa, .wpl, .arj, .deb, .pkg, .db, .dbf, .sav, .xml, .html, .aiml, .apk, .bat, .bin, .cgi, .pl, .com, .wsf, .bmp, .bmp, .gif, .tif, .tiff, .htm, .js, .jsp, .php, .xhtml, .cfm, .rss, .key, .odp, .pps, .ppt, .pptx, .class, .cd, .java, .swift, .vb, .ods, .xlr, .xls, .xlsx, .dot, .docm, .dotx, .dotm, .wpd, .wps, .rtf, .sdw, .sgl, .vor, .uot, .uof, .jtd, .jtt, .hwp, .602, .pdb, .psw, .xlw, .xlt, .xlsm, .xltx, .xltm, .xlsb, .wk1, .wks, .123, .sdc, .slk, .pxl, .wb2, .pot, .pptm, .potx, .potm, .sda, .sdd, .sdp, .cgm, .wotreplay, .rofl, .pak, .big, .bik, .xtbl, .unity3d, .capx, .ttarch, .iwi, .rgss3a, .gblorb, .xwm, .j2e, .mpk, .xex, .tiger, .lbf, .cab, .rx3, .epk, .vol, .asset, .forge, .lng, .sii, .litemod, .vef, .dat, .papa, .psark, .ydk, .mpq, .wtf, .bsa, .re4, .dds, .ff, .yrp, .pck, .t3, .ltx, .uasset, .bikey, .patch, .upk, .uax, .mdl, .lvl, .qst, .ddv, .pta

Extension list source: Bleeping Computer

When observing that list is revealed that many extensions belong to files of computer games and their “saves”. Each file that gets encrypted will receive the same extension appended after its original extension. The second extension after the original one will be .kirked.

In the ransom note, there is a section mentioning a Spock decryption tool, that you have to pay for if you want your files returned to normal. For the moment, there is no other information about decryption other than malware researchers saying that it doesn’t seem possible yet.

However, if you want to have any chance of decryption in the future, you should keep a file called pwd that is found under the same directory as the file loic_win32.exe, which is the ransomware executable file.

The Kirk cryptovirus is not excluded to delete the Shadow Volume Copies from the Windows operating system by utilizing the following command:

→vssadmin.exe delete shadows /all /Quiet

Although, that is highly unlikely, as its main target probably isn’t the Windows OS to begin with.

Read on through and check out what type of ways you can try to potentially restore some of your data.

Remove Kirk Ransomware and Restore .Kirked Files

If your computer got infected with the Kirk ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.

Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share