Pierluigi Paganini March 26, 2019

Good news for the victims of the Hacked Ransomware, the security firm Emsisoft has released a free decryptor to decrypt the data of infected computers.

Security experts at Emsisoft released a free decryptor for the Hacked Ransomware. The Hacked Ransomware was first spotted in 2017, it appends .hacked extension to the encrypted files and includes ransom notes in Italian, English, Spanish, and Turkish.

Experts observed a large number of infections, the malicious code pretends to be a windows update, it displays a fake Windows Update screen while encrypting a victim’s files.

In 2018, the popular malware researcher Michael Gillespie discovered a weakness in the encryption process that allowed the expert to create a decryption tool.

Victims of the Hacked Ransomware can download the decrypt_HKCrypt.exe executable from the Emsisoft website.

“HKCrypt (also known as “Hacked Ransomware”) first appeared in late 2017, and encrypts a victim’s files using the RC4 algorithm, then adds the extension “.hacked” to files. The malware pretends to be running a Windows update, then shows a lock screen telling the victim to contact “[email protected]”.” states the post published on the
Emsisoft website.

“This ransomware also leaves ransom notes in English (@readme_English.txt or How_to_decrypt_files.txt), Spanish (@Readme_Spanish.txt), and Italian (@Leggimi_decrypt_Italian.txt). “

Victims have to launch the program with administrative privileges, once executed the decryptor tool will search the computer for encrypted files and automatically decrypt them.

Yeasterday, I wrote about another threat, the PewDiePie ransomware, that obliges users to subscribe to PewDiePie YouTube channel. Well, experts an Emsisoft also released a free decryptor tool for this threat.

Pierluigi Paganini

(SecurityAffairs – Hacked ransomware, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]