HollyCrypt is malicious software that encrypts your files and demands a ransom for the decryption key.

History

HollyCrypt Ransomware was first discovered in November 2016.

How does HollyCrypt Ransomware work?

When HollyCrypt is first executed, it will check for the presence of specific process names. If any of the following processes are running, the HollyCrypt will terminate itself:- taskmgr.exe- procexp.exe- msconfig.exe- regedit.exe- gpedit.mscIf HollyCrypt does not detect any of these processes, it will proceed with encryption. HollyCrypt uses the AES-256 encryption algorithm to encrypt files and appends .hbyte to the encrypted filename. For example, a file named 1.jpg would be renamed to 1.jpg.hbyte . HollyCrypt will also create a text file named Read_ME_to_DECRYPT.txt, which contains instructions on how to decrypt your files.

What does a HollyCrypt ransom note look like?

All HollyCrypt ransom notes contain the same text:All of your important files are encrypted!Don’t worry, you can still recover your files. To do so, you need to purchase the HollyCrypt Decryption Tool from our website.

How much does it cost?

The HollyCrypt Decryption Tool costs $500. You can make payment via Bitcoin, Perfect Money, or Paypal.If you do not pay the ransom within 7 days, the price will double.

What was the biggest HollyCrypt attack?

In December 2016, HollyCrypt Ransomware targeted a school district in California, encrypting over 10,000 files. The school district ended up paying the ransom and had all their files decrypted.

What types of files does HollyCrypt encrypt?

HollyCrypt Ransomware primarily targets image, audio, video, and document files. However, it will also encrypt other types of files if they are found on the infected system.

Protection

Attackers typically spread HollyCrypt through spam emails or fake downloads. To protect yourself from HollyCrypt, we recommend that you avoid opening attachments or clicking links in emails from unknown senders. We also recommend that you download software from reputable sources and avoid using pirated software. Finally, we recommend that you install a reputable anti-malware program and keep it up to date.

What should I do?

If they have infected you with HollyCrypt Ransomware, we do not recommend paying the ransom, as there is no guarantee that your files will be decrypted. Instead, we recommend that you use a reputable anti-malware program to remove HollyCrypt.HollyCrypt is a difficult virus to remove manually, so we do not recommend attempting to do so.If you have a backup of your files, you can restore them from the backup. If you do not have a backup, we recommend using data recovery software to recover your files. HollyCrypt Ransomware attempts to delete shadow copies of your files, so data recovery may not be possible in all cases. However, it is worth a try as it may be the only way to recover your files.You can try SalvageData data recovery software.

Is there a public decryption tool?

At this time, there is no public decryption tool available for HollyCrypt. However, security researchers are working on creating one. We will update this article as soon as a decryption tool becomes available.

Contact a data recovery service

SalvageData has been helping HollyCrypt victims recover their data since 2016. We offer a free evaluation to HollyCrypt victims and have a success rate of over 90%.Contact us for a free consultation.