GhostCrypt is a type of malware that encrypts your files and demands a ransom to decrypt them. This ransomware may add an extension to your encrypted files, making them unable to be opened without the decryption key. GhostCrypt Ransomware may spread through email attachments or by downloading infected files from malicious websites. Other malware may also install GhostCrypt, such as Trojans.

History

GhostCrypt Ransomware was first discovered in 2016. This is a variant of the CryptXXX Ransomware. GhostCrypt has been known to use the following file extensions for encrypted files: .ghost, .cryp1, .crypz, and .cryp7.

What encryption algorithm does GhostCrypt use?

GhostCrypt Ransomware uses the RSA-2048 encryption algorithm.

Ransom note

GhostCrypt Ransomware will leave a ransom note named Ghost-DECRYPT.txt or Ghost-DECRYPT.html in the same folder as the encrypted files. The ransom note will contain instructions on how to pay the ransom and decrypt your files.

How much is the ransom?

The GhostCrypt Ransomware will encrypt your files and demand a ransom of between 0.5 and 2 Bitcoin. So, the price may range from $200 to $8000 at the current exchange rate.

Should you pay the ransom?

You should not pay the GhostCrypt Ransomware ransom as there is no guarantee that you will receive the decryption key even if you do pay. Additionally, paying the ransom would only encourage the criminals to continue their activities.

What was the biggest GhostCrypt ransomware attack?

The GhostCrypt Ransomware has been used in several attacks, including the 2016 Petya/NotPetya attack that caused over $10 billion in damages.

What types of files does GhostCrypt Ransomware encrypt?

GhostCrypt Ransomware will encrypt a variety of files, including images, videos, documents, and more.

Prevention

There are some things you can do to prevent GhostCrypt ransomware:-Install and run anti-malware software-Keep your operating system and software up-to-date-Don’t open email attachments from unknown senders-Don’t download files from untrustworthy websites-Back up your files regularly

What are the symptoms?

The symptoms of GhostCrypt Ransomware include:-Your files are encrypted and have a new extension-A ransom note is left in the same folder as the encrypted files-Your computer is connected to the internet

What should you do?

If you suspect that GhostCrypt Ransomware has infected your computer, you should take the following steps:-Disconnect your computer from the internet-Run a malware scanner such as Malwarebytes to remove the ransomware-Use a file recovery program to try to recover your files. We built SalvageData data recovery software to help you.-Contact a data recovery service such as SalvageData

Is there a public decryption tool for GhostCrypt ransomware?

There is currently no public decryption tool available for GhostCrypt ransomware.

Contact a data recovery service

If you are not able to remove GhostCrypt ransomware or decrypt your files, you should contact a data recovery service.SalvageData can help you recover your files. We offer a free consultation to help you determine if we can recover your data, no-risk pricing (you only pay if we’re successful), and a no data - no-charge guarantee.SalvageData experts are available 24/7. Contact us now to get professional help.