Lock.onion Files Virus (KRAKEN CRYPTOR) – Remove + Restore Data

Lock.onion Files Virus (KRAKEN CRYPTOR) – Remove + Restore Data

This article has been created to help explain what is KRAKEN CRYPTOR ransomware virus and how you can effectively remove it from your computer plus how you can restore files, encrypted with the Lock.onion file extension added to them.

A new ransomware variant has recently been uncovered by security researchers, and it seems to call itself KRAKEN CRYPTOR. The ransomware virus aims to leave behind the encrypted files on the computer it infects in a renamed variant that gives them the number and adds the Lock.onion suffix, for example 0000001-Lock.onion. According to the reputable malware researcher Jakub Kroustek, the ransomware seems to be a new variant and it extorts victims into paying a large amount of money in BitCoin. If your computer has been infected by KRAKEN CRYPTOR, we recommend that you read this article thoroughly as it will show you how you can remove this ransomware and hopefully restore as many files encrypted by it as possible.

Threat Summary

TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on the victims’ computers and makes them unrecognizable and no longer usable until the victim pays ransom in BitCoin.
SymptomsFiles are completely renamed with the added Lock.onion suffix and a ransom note is dropped, called #How to Decrypt Files.txt.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by KRAKEN CRYPTOR


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss KRAKEN CRYPTOR.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

KRAKEN CRYPTOR – Update October 2018

October 2018 brings news around KRAKEN CRYPTOR. As this RaaS (Ransomware as a Service) is actively being distributed by affiliates, the current one responsible for the delivery of the virus is the Fallout Exploit kit. Fallout EK used to spread GandCrab, and leverage CVE-2018-4878, CVE-2018-8174 vulnerabilities. It seems that the ransomware that is being pushed from the exploit kit is ever changing.

KRAKEN CRYPTOR – Infection Methods

Many do believe that KRAKEN CRYPTOR is made by the same people behind Kraken Ransomware, which was detected a while back, but it seems to have little in common with the virus as researchers do believe that the code is new. Either way, this dangerous malware string may find its way into your computer as a result of you having to open a malicious e-mail attachment sent to you. Such attachments may be directly added to the e-mail as a seemingly important document, for example:

  • Invoice.
  • Purchase receipt.
  • Banking letter.
  • Activity report.

The attachment may also beadded in the form of a web link, like the spam e-mail scenario examples below show:

“Dear { Your Name }
There is suspicious activity on your bank account. “
(Scenario 1)
“Please visit the following web link to verify your information: “
{ malicious URL }
(Scenario 2)
“For more information on your transaction history, please view the attachment on this e-mail.”

After the user clicks on the web link or downloads and runs the attachment file, the infection may commence. The malicious files that you should be careful if you are not sure what to look for often are from the following file types:

→ .jse, .js, .wsf, .bat, .hta, .html, .htm, .vbs

The KRAKEN ENCRYPTOR may also infect your computer by adding fake Microsoft Office documents to it that contain malicious macros and may infect your machine in the following chain of activities:

KRAKEN CRYPTOR Ransomware – Activity Report

Once you have become infected with KRAKEN CRYPTOR, researchers have detected that the ransomware virus may drop the following file detection on your computer:

→ Name: Kraken.exe
SHA-256: 528e4d24c18160b6bdd73c9a612d38a78fc58bd40c8ab415973a94429b321dfc
Size:94 KB

Among the files dropped by the KRAKEN CRYPTOR is it’s ransom note, whose main purpose is to lead you into paying a hefty ransom fee to the cyber extortionists. The ransom note is called #How to Decrypt Files.txt and has the following message to victims:


Text from Image:

What happened to my computer?

All of your files such as documents. images. videos and other files with the different names and extensions are encrypted by “KRAKEN CRYPTOR”!
The speed, power and complexity of this encryption have been high and if you are now viewing this guide.

It means that “KRAKEN CRYPTOR” immediately removed form your system!

No way to recovery your files without “KRAKEN DECRYPTOR” software and your computer “UNIQUE KEY”!

You need to buy it rom us because only we can help you!

what the mean is encryption?

In cryptography. encryption is the process of encoding a message or information in such a way that only authorized parties can access it.
And t ose who are not authorized cannot.

How can recover my files?

we guarantee that you can recover all your files soon safely.

You can decrypt one of your encrypted smaller file for free in the first contact wfith us.

For the decryption serv ce, we a so need your “KRAKEN ENCRYPTED UNIQUE KEY” you can see this in the top!

Are you want to decrypt all of your encrypted files? if yes! You need to pay for decryption service to us!

After your payment made. all of your encrypted files has been decrypted.

How much is need to pay?

You need to pay (0.125 BTC), payment only can made as Bitcoins.

This links help you to understand whats s a Bitcoins and how it work:


How to obtain Bitcoins?

The easiest way to buy Bitcoins is LocalBitcoins website.

You must register on this site and click “BUY Bitcoins” then choose your country to find sellers and their prices.

Other places to buy Bitcoins in exchange for other currencies:


The Kraken.exe file may be accompanied with other files of this type, that may have the same or similar names. These files are often known as modules and they aim to perform different malicious functions in the ransomware’s infection acitivity.

One of those functions is to modify the Windows Registry Editor of your machine by adding various malicious registry sub-key values into the Run and RunOnce sub-keys that have the following locations:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\

In addition to this, the KRAKEN CRYPTOR ransomware virus may execute different commands as an administrator on your computer in order to disable Windows Recovery and delete the backed up files and shadow copies from your computer. The commands may be the following:

→ sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet

KRAKEN CRYPTOR – Encryption Process

To encrypt the files on your computer, KRAKEN CRYPTOR first has to find them. The virus has a pre-configured method by which it scans your PC for the files that you use very often, such as:

  • Videos.
  • Documents.
  • Images.
  • Archives.
  • Audio files.
  • Virtual Drives.
  • Databases.

The virus also adds severa Windows folders to it’s whitelist so that it does not encrypt files in them and hence prevents your OS from being damaged by it. Other than that all other files are comletely renamed with a number, making them look like the following:

Remove KRAKEN CRYPTOR and Restore Lock.onion Encrypted Files

If you want to fully and effectively remove this ransomware virus from your computer, we suggest that you follow the manual or automatic removal instructions below. Bear in mind tha this virus is a sophisticated type of threat and it’s removal should be done only if you have experience, because an unproper removal may leave the ransomware still on your PC and your files may also be permanently damaged. This is why, for maximum effectiveness experts often recommend turning to advanced anti-malware software. Downloading and running a scan with such a program will make sure that your KRAKEN CRYPTOR and other malware and unwanted software residing on your PC is fully removed and your Windows machine remains protected against any future infections as well.

If you are looking for a way to restore files that have been encrypted on your computer with the Lock.onion file extension, we would suggest that you try out the alternative file recovery methods in step “2. Restore files, encrypted by KRAKEN CRYPTOR”. They may not be 100% solution, but they are much better than paying the actual ransom to crooks who may just run away with the money.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share