How to get back files encrypted by the Hacked Ransomware for free

Good news for the victims of the Hacked Ransomware, the security firm Emsisoft has released a free decryptor to decrypt the data of infected computers.

Security experts at Emsisoft released a free decryptor for the Hacked Ransomware. The Hacked Ransomware was first spotted in 2017, it appends .hacked extension to the encrypted files and includes ransom notes in Italian, English, Spanish, and Turkish.

Experts observed a large number of infections, the malicious code pretends to be a windows update, it displays a fake Windows Update screen while encrypting a victim’s files.

In 2018, the popular malware researcher Michael Gillespie discovered a weakness in the encryption process that allowed the expert to create a decryption tool.

Victims of the Hacked Ransomware can download the decrypt_HKCrypt.exe executable from the Emsisoft website.

“HKCrypt (also known as “Hacked Ransomware”) first appeared in late 2017, and encrypts a victim’s files using the RC4 algorithm, then adds the extension “.hacked” to files. The malware pretends to be running a Windows update, then shows a lock screen telling the victim to contact “payment.hkdecrypt@mail.ru”.” states the post published on the
Emsisoft website.

“This ransomware also leaves ransom notes in English (@readme_English.txt or How_to_decrypt_files.txt), Spanish (@Readme_Spanish.txt), and Italian (@Leggimi_decrypt_Italian.txt). “

Victims have to launch the program with administrative privileges, once executed the decryptor tool will search the computer for encrypted files and automatically decrypt them.

Yeasterday, I wrote about another threat, the PewDiePie ransomware, that obliges users to subscribe to PewDiePie YouTube channel. Well, experts an Emsisoft also released a free decryptor tool for this threat.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Hacked ransomware, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.