The article will help you to remove Dikkat ransomware efficiently. Follow the ransomware removal instructions provided at the end of this article.
The Dikkat ransomware is also called Kripto because of its payload put into an executable with that name. This virus has been discovered by the malware researcher Karsten Hahn. The ransomware is a variant of HiddenTear. The Dikkat cryptovirus displays a window with a ransom message written in Turkish, which suggests that Turkish-speaking users are the main target. Read on to find out how you may potentially recover your data.
|Short Description||The ransomware virus is a HiddenTear variant and will encrypt your files.|
|Symptoms||The ransomware will display a window containing instructions about payment in Turkish after it encrypts files.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by Dikkat |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Dikkat.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Dikkat Ransomware – Delivery Methods
Dikkat ransomware could spread its infection via different methods. The payload file that initiates the malicious script for this ransomware, which in turn infects your computer machine, is circling the Internet and a malware sample has been found by Karsten Hahn – a malware researcher. You can see the VirusTotal detections for different security programs of that sample by checking the screenshot below:
Dikkat ransomware could also distribute its payload file along social media websites and file-sharing networks. Freeware applications which are found on the Web could be presented as useful but at the same time could be hiding the malicious script for the cryptovirus. Refrain from opening files right when you have downloaded them, especially if they come from dubious sources such as links or e-mails. Instead, you should scan them beforehand with a security tool, while also checking the sizes and signatures of these files for anything that seems suspicious. You should read the ransomware prevention tips thread on the forum.
Dikkat Ransomware – More Information
Dikkat is the name of this ransomware cryptovirus. That is what is says at the top of its ransom message screen, but Dikkat is a Turkish word that means Attention. Its payload file is found inside a file called Kripto.exe so some researchers have dubbed it “Kripto”. The whole ransom note is written in the Turkish language. That suggests that Turkish-speaking users will be the main target of attacks for the ransomware, but does not exclude somebody else getting infected as well.
Dikkat ransomware might make entries in the Windows Registry aiming to achieve a higher level of persistence. Those registry entries are typically designed in a way that will start the virus automatically with each launch of the Windows Operating System.
The ransom message will show up inside a window after the encryption process is complete. The note provides the demands for payment and similar instructions. The note of Dikkat may have a lockscreen feature and is written in Turkish as already mentioned above. You can see that note from the below screenshot:
That ransom message reads the following:
!!! Dikkat !!!
UYARI: BİLGİSAYARINIZDAKİ TÜM VERİLER VE DOSYALAR ŞİFRELENDİ!
SİZDE ŞİFRELENEN DOSYALARINıZ İÇİN 500TL BİR DEFAYA MAHSUS BİR ÜCRET TALEP EDİYORUZ.
BELİRTİLEN ÜCRETİ ÖDEDİĞİNİZ TAKDİRDE SİSTEMİNİZE BAĞLANıYORUZ VE KİLİTLİ DOSYALARıNıZı AÇıYORUZ.
YıLLARıN VERDİĞİ TECRÜBEYE DAYANARAK SÖYLEYEBİLİRİMKİ DOSYALARıNıZı BİZDEN BAŞKA KİMSE SİZE GERİ VEREMEZ.
İNDİRİLEN VİRÜSE KENDİNİZ ÖZGÜR İRADENİZLE TıKLADıĞıNıZ VE AYRıCA TÜM İŞLEMİ KENDİ BİLGİSAYARINIZ YAPTIĞI İÇİN SUÇ DUYURUSUNDA BULUNMANıZ BİR ŞEY İFADE ETMEZ.
ÖDEMEYİ ALDıKTAN SONRA BİLGİSAYARıNıZDAKİ TÜM ŞİFRELERİ DOSYALARı AÇıYORUZ VE ALT KATMAN TEMİZLİĞİ YAPıYORUZ VE KALDıĞıNıZ YERDEN DEVAM EDİYORSUNUZ.
REFERANS NUMARANıZ: ÖRNEK REFERANS NUMARASı BİZİMLE İLETİŞİME GEÇERKEN REFERANS NUMARANıZı YAZıNKI SIZIN KİM OLDUĞUNUZU BİLELİM.
Parayı 5 gün içinde yani –/–/2017 tarihine kadar ödemezseniz bilgisayarınız imha edilecek!
A rough translation of the note in English will look like the following:
!!! Attention !!!
WARNING: ALL DATA AND FILES ON YOUR COMPUTER ARE ENCRYPTED!
WE HAVE A FEE REQUIRED OF 500TL FOR YOUR FILES YOU ENGAGED IN YOURSELF.
UNLESS YOU HAVE PAID THE SPECIFIED CHARGES YOU ARE NOT CONNECTED TO YOUR SYSTEM AND DO NOT OPEN YOUR LOCKED FILES.
YOU CAN NOT RETURN ANYONE TO YOU THROUGH YOUR FILES YOU CAN TELL AS A FUNCTIONAL EXPERIENCE.
YOU DO NOT EXPRESS ANYTHING IN THE CRIME OF THE OFFERED VIRUS FOR YOURSELF AND YOUR OWN COMPUTER HAS ALL THE PROCESSING OF YOUR OWN COMPUTER.
YOU’RE NOT ALREADY CLEANING THE LOWER LAYER CLEANING AND CONTINUING YOUR NUMBER OF PASSWORDS IN THE COMPUTER AFTER YOU PAYED.
REFERENCE NUMBER: SAMPLE REFERENCE NUMBER REFERENCE NUMBER SUBJECT TO YOU TO CONTACT US.
If you do not pay the money within 5 days, ie –/–/2017, your computer will be destroyed!
The developer of the Dikkat cryptovirus has written a big threat message, but doesn’t reveal much. You are demanded to pay 500 in the Turkish Lira currency which equals 135 US dollars. If you get your computer infected with the malware, you should NOT under any circumstances pay the cybercriminal who is behind it. Nobody could guarantee that you will get your files restored.
Dikkat Ransomware – Encryption Process
The Dikkat ransomware is a variant of HiddenTear, associated with the HiddenTear/EDA2 open source project. Chances are that is uses AES for its encryption algorithm and has a high probability to seek and encrypt files, which have the same extensions encrypted by previous HiddenTear variants. These extensions are:
→.txt, .doc, .docx, .xls, .xlsx, .pdf, .pps, .ppt, .pptx, .odt, .gif, .jpg, .png, .db, .csv, .sql, .mdb.sln.php, .asp, .aspx, .html, .xml, .psd, .frm, .myd, .myi, .dbf, .mp3, .mp4, .avi, .mov, .mpg, .rm, .wmv, .m4a, .mpa, .wav, .sav, .gam, .log, .ged, .msg, .myo, .tax, .ynab, .ifx, .ofx, .qfx, .qif, .qdf, .tax2013, .tax2014, .tax2015, .box, .ncf, .nsf, .ntf, .lwp
The Dikkat cryptovirus could be set to delete the Shadow Volume Copies from the Windows operating system with the help of the following command:
→vssadmin.exe delete shadows /all /Quiet
If that command is executed, the encryption process will become more efficient as it eliminates one of the viable ways to restore your files. Read on to check out what ways you could try to recover your data.
Remove Dikkat Ransomware and Restore Your Data
If your computer got infected with the Dikkat ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.