Remove HolyCrypt Ransomware and Restore (encrypted) Files - How to, Technology and PC Security Forum | SensorsTechForum.com

Remove HolyCrypt Ransomware and Restore (encrypted) Files

alert-ransom-note-sensorstechforumRansomware virus makes have no breaks, even during summer seasons. A perfect example for that is the lately active 64-bit HolyCrypt ransomware which adds the (encrypted) name prefix at the beginning of the file names of the objects it encrypts. The ransomware virus then drops a ransom not asking users to send 3 files to the e-mail address [email protected] The ransomware also adds a picture and changes it as a wallpaper on the infected machine with a further notification message. Users who have had their computers infected by HolyCrypt ransomware are strongly advised to not pay any ransom money to cyber-criminals and instead to read this article to see how to remove it and what options are available for the moment.

Threat Summary

Name

HolyCrypt

TypeRansomware
Short DescriptionHolyCrypt enciphers users’ files and drops a ransom note as a picture file, named “alert.jpg”
SymptomsThe user may witness ransom message as his wallpaper with a skull image.
Distribution MethodVia an spam e-mail campaigns carrying malicious attachments, Exploit Kits or malicious URLs.
Detection Tool See If Your System Has Been Affected by HolyCrypt

Download

Malware Removal Tool

User ExperienceJoin our forum to Discuss HolyCrypt Ransomware.

HolyCrypt Ransomware – Distribution Information

The funny name carrying virus may infect user PCs via different spam e-mail campaigns. One of those may be the distribution of spam messages across a preset list of e-mail addresses. Such lists are collected via cookies on shady websites as well as via adware and browser hijackers which have tracking technologies and collect different information from users. Sometimes, such information may be collected from compromised websites’. The cyber-criminals may steal the list of registered accounts if they conduct a data breach attack and may sell the information on the deep web or use it themselves to conduct spam campaigns that may spread malware like HolyCrypt Ransomware. Such spam messages may include HolyCrypt’s payload dropper as an attachment or a malicious URL leading to it.

HolyCrypt Ransomware – More Information About It

As soon as HolyCrypt Ransomware has been activated on the computer of the victim, it may immediately drop its payload in one of the key Windows folders where ransomware usually resides:

  • %User’s Profile%
  • %Local%
  • %Temp%
  • %AppData%
  • %SystemDrive%
  • %SystemRoot%
  • %LocalAppData%
  • %ProgramData%
  • %WinDir%

As soon as it has been dropped HolyCrypt ransomware may start the modification of keys in the Windows Registry entry to change certain settings that suit its needs. Some of those settings may be adding values in the “Run” key which will allow for its encryption process to start when you boot Windows:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

As soon as it encryptor runs on your computer, the virus targets files of the following types:

  • Videos.
  • Documents.
  • Audio files.
  • Databases.
  • Microsoft Office files.
  • Files compatible with widely used software.

The HolyCrypt virus also skips encrypting files in key Windows folders that may damage the operating process of the OS. After encryption, the virus adds “(encrypted)” prefix at the start of the name of the encoded files, for example:

(encrypted)filename.jpg

The encoded files are ciphered via using an immensely strong cipher, and they can no longer be opened by any software. After encryption, HolyCrypt Ransomware drops the following file on the infected machine:

  • Alert.jpg

The virus also may tamper with the following registry key because it immediately changes the wallpaper of the user:

HKEY_CURRENT_USER\Control Panel\Desktop

The wallpaper is changed to an image with a skull and the below-stated ransom note:

“YOUR COMPUTER HAS BEEN LOCKED!
alert-ransom-note-sensorstechforum-fileYour documents, photos, databases and other important files have been locked with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key.
The server will eliminate the key after 24h.
Open http://test_ransonware.onion.link and follow the instruction for the payment”

This virus generates a private decryption key which suggests that either an RSA or an AES ciphers have been used in this attack. Since malware researchers believe that this virus may have been written in Python, it may even be distributed in GitHub, for free. We have researched it and discovered a related file encryptor also written in Python, carrying the name Holy-Crypt. This may be a possible indicator that the criminals behind HolyCrypt ransomware may have taken this open source code to modify it and include it in the HolyCrypt ransomware attacks.

Remove HolyCrypt Ransomware and Restore Encoded Files

To delete this file-encryption virus, we strongly advise you to follow the instructions which we have provided below. They are methodologically arranged for maximum effectiveness to help you remove HolyCrypt files. In case you have difficulties in manually removing HolyCrypt’s files and registry entries from your computer, experts advise using an advanced anti-malware program. It will ensure that all objects associated with HolyCrypt ransomware are permanently deleted from your computer, and it will stop future threats on their tracks as well.

In case you are looking forward to exploring methods to restore your files, we have provided several alternative suggestions in step “3. Restore files encrypted by HolyCrypt” below. They may not be 100 percent effective, but some of our readers have managed to restore their files with them. Bear In mind that you should research these methods before attempting them as there is no guarantee whether or not they will work successfully and safely.

Manually delete HolyCrypt from your computer

Note! Substantial notification about the HolyCrypt threat: Manual removal of HolyCrypt requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove HolyCrypt files and objects
2. Find malicious files created by HolyCrypt on your PC
3. Fix registry entries created by HolyCrypt on your PC

Automatically remove HolyCrypt by downloading an advanced anti-malware program

1. Remove HolyCrypt with SpyHunter Anti-Malware Tool
2. Back up your data to secure it against infections and file encryption by HolyCrypt in the future
3. Restore files encrypted by HolyCrypt
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.