New version of the Razy ransomware virus, known by the name Krypte has been released and has begun encrypting files with what appears to be an AES cipher. The virus has been created exclusively for German users. The virus aims primarily to encrypt the files on the compromised computer and demand a ransom payoff for the successful decryption of the files it has encrypted. Everyone who has been infected by this ransomware virus should immediately take precautions and remove it from their computer. In case the virus has successfully encrypted your files, it is strongly advisable to try alternative methods such as the ones after this article to decipher your files while we update it with a free decryptor when released.
|Short Description||The malware encrypts users’ files using AES encryption, changing the wallpaper with its ransom message.|
|Symptoms||The user may witness ransom messages and “instructions” on how to make a payoff.|
|Distribution Method||It may spread via malicious PDFs and an Infostealer featured in spam e-mail messages.|
|Detection Tool|| See If Your System Has Been Affected by Krypte |
Malware Removal Tool
|User Experience||Join our forum to Discuss Krypte Ransomware.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Krypte Ransomware – How Does It Spread
Krypte Ransomware In Detail
As soon as the exploit kit has been activated on the compromised computer, it may initiate a download of the malicious files, belonging to Krypte. The malicious files may be different types and may have different functions as well:
→ exe, .bat, .vbs, .js, .cmd, .dll, .tmp
Krypte may drop the files with different names in key Windows folders, usually targeted by ransomware viruses, such as the following:
After this has been done, the Krypte malware may initiate files that set it’s encryption module to run on Windows startup. The targeted Windows keys for this are reported to be the Run and RunOnce keys located in subkeys of HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.
As soon as Krypte begins encrypting user files, it may scan for the following expansions in order to encipher them:
“PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”Source:fileinfo.com
When it encrypts user files, Krypte may use an Advanced Encryption Standard cipher, which changes the structure of the files so that they become un-openable by any type of software. To notify the user that his only option may seem to be to pay ransom money in BitCoin, Krypte uses the following ransom note, which it may set as a wallpaper:
→“Hallo! Ich bin Krypte! Eine Ransomware! Ich habe deine Dokumente, Musik, Bilder und andere Wichtige dateien mit einer AES Verschlusselung Verschlusselt. Wenn du deine Daten wiederhaben willst dann Befolge Bitte diese Anweisungen:
Kaufe eine 15-20 Euro Paysafe-Karte und gebe diesen Code in die Textbox Unten ein.
Trage deine Email-Adresse in die Andere Textbox ein und drucke auf Weiter.
Wenn der Paysafekarten-code richtig sein sollte, Bekommst du an deine Email einen Key + Entfern und Entschlusselungsprogramm.
An deiner steller wurde ich kein Antivierenprogrammm laufen lassen und nicht versuchen, diesen Virus zun enfernen. Dieses Progrmm ist deine einzige moglichkeit, deine Daten zuruckzubekommen.
Dein Private-Key wird nach 72h von unserem Server geloscht.
Viel Erfolg :)”
English Translation by Google Translate:
“Hello! I am crypt! A ransomware! I have your documents, music, pictures and other important files with an AES encrypted algorithm. If you want to back your data have then Follow these instructions Please:
Buy a 15-20 Euro Paysafe card and give this code in the text box below a.
Fill in your email address in the Other text box and prints Next.
If the Pay safe card code should be right, Do you get your email address to a Key + eliminator and Entschlusselungsprogramm.
The Upside steller I was running no Antivirus programand not try this virus unregistering ton. This Progrmm is your only way to zuruckzubekommen your data.
Your private key is deleted after 72 hours from our server.
I wish you success :)”
Krypte Ransomware – Conclusion and Removal and File Restoration Instructions
As a bottom line, according to ransomware researchers from Malware Hunter Team, this particular ransom virus is just as junk as the previous Razy variant was. But this does not mean you should take it lightly. First, it is advisable to make a backup of the encrypted files after which use the instructions after this article to remove the Krypte virus completely from your computer.
In order to restore your files, it is NOT advisable to pay the ransom and NOT advisable to try and use third-party decrypters that are not made for this specific variant. This is why we recommend to attempt the instructions in step “2. Restore files encrypted by Krypte” below with extreme caution and backup the encrypted files before trying them.