Ransomware virus makes have no breaks, even during summer seasons. A perfect example for that is the lately active 64-bit HolyCrypt ransomware which adds the (encrypted) name prefix at the beginning of the file names of the objects it encrypts. The ransomware virus then drops a ransom not asking users to send 3 files to the e-mail address [email protected] The ransomware also adds a picture and changes it as a wallpaper on the infected machine with a further notification message. Users who have had their computers infected by HolyCrypt ransomware are strongly advised to not pay any ransom money to cyber-criminals and instead to read this article to see how to remove it and what options are available for the moment.
Threat Summary
| Name | HolyCrypt |
| Type | Ransomware |
| Short Description | HolyCrypt enciphers users’ files and drops a ransom note as a picture file, named “alert.jpg” |
| Symptoms | The user may witness ransom message as his wallpaper with a skull image. |
| Distribution Method | Via an spam e-mail campaigns carrying malicious attachments, Exploit Kits or malicious URLs. |
| Detection Tool | See If Your System Has Been Affected by HolyCrypt Download Malware Removal Tool |
| User Experience | Join our forum to Discuss HolyCrypt Ransomware. |
HolyCrypt Ransomware – Distribution Information
The funny name carrying virus may infect user PCs via different spam e-mail campaigns. One of those may be the distribution of spam messages across a preset list of e-mail addresses. Such lists are collected via cookies on shady websites as well as via adware and browser hijackers which have tracking technologies and collect different information from users. Sometimes, such information may be collected from compromised websites’. The cyber-criminals may steal the list of registered accounts if they conduct a data breach attack and may sell the information on the deep web or use it themselves to conduct spam campaigns that may spread malware like HolyCrypt Ransomware. Such spam messages may include HolyCrypt’s payload dropper as an attachment or a malicious URL leading to it.
HolyCrypt Ransomware – More Information About It
As soon as HolyCrypt Ransomware has been activated on the computer of the victim, it may immediately drop its payload in one of the key Windows folders where ransomware usually resides:
- %User’s Profile%
- %Local%
- %Temp%
- %AppData%
- %SystemDrive%
- %SystemRoot%
- %LocalAppData%
- %ProgramData%
- %WinDir%
As soon as it has been dropped HolyCrypt ransomware may start the modification of keys in the Windows Registry entry to change certain settings that suit its needs. Some of those settings may be adding values in the “Run” key which will allow for its encryption process to start when you boot Windows:
→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
As soon as it encryptor runs on your computer, the virus targets files of the following types:
- Videos.
- Documents.
- Audio files.
- Databases.
- Microsoft Office files.
- Files compatible with widely used software.
The HolyCrypt virus also skips encrypting files in key Windows folders that may damage the operating process of the OS. After encryption, the virus adds “(encrypted)” prefix at the start of the name of the encoded files, for example:
The encoded files are ciphered via using an immensely strong cipher, and they can no longer be opened by any software. After encryption, HolyCrypt Ransomware drops the following file on the infected machine:
- Alert.jpg
The virus also may tamper with the following registry key because it immediately changes the wallpaper of the user:
The wallpaper is changed to an image with a skull and the below-stated ransom note:
Your documents, photos, databases and other important files have been locked with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key.The server will eliminate the key after 24h.
Open http://test_ransonware.onion.link and follow the instruction for the payment”
This virus generates a private decryption key which suggests that either an RSA or an AES ciphers have been used in this attack. Since malware researchers believe that this virus may have been written in Python, it may even be distributed in GitHub, for free. We have researched it and discovered a related file encryptor also written in Python, carrying the name Holy-Crypt. This may be a possible indicator that the criminals behind HolyCrypt ransomware may have taken this open source code to modify it and include it in the HolyCrypt ransomware attacks.
Remove HolyCrypt Ransomware and Restore Encoded Files
To delete this file-encryption virus, we strongly advise you to follow the instructions which we have provided below. They are methodologically arranged for maximum effectiveness to help you remove HolyCrypt files. In case you have difficulties in manually removing HolyCrypt’s files and registry entries from your computer, experts advise using an advanced anti-malware program. It will ensure that all objects associated with HolyCrypt ransomware are permanently deleted from your computer, and it will stop future threats on their tracks as well.
In case you are looking forward to exploring methods to restore your files, we have provided several alternative suggestions in step “3. Restore files encrypted by HolyCrypt” below. They may not be 100 percent effective, but some of our readers have managed to restore their files with them. Bear In mind that you should research these methods before attempting them as there is no guarantee whether or not they will work successfully and safely.
