KratosCrypt is a new ransomware that was first spotted in the wild in early May 2019.

How does KratosCrypt spread?

Attackers primarily spread KratosCrypt through spam emails that contain malicious attachments. These attachments are typically Word or PDF documents that have been infected with a macro that downloads and executes KratosCrypt on the victim’s machine.

What does KratosCrypt do?

When KratosCrypt is executed, it will scan the victim’s hard drive for certain file types and encrypt them using the AES-256 encryption algorithm. KratosCrypt will then append the “.kcr” extension to the encrypted files. Once the encryption process is complete, KratosCrypt will drop a ransom note named “!DECRYPTION INFO!.txt” which contains instructions on how victims can decrypt their files.

What types of files does KratosCrypt encrypt?

KratosCrypt will encrypt common file types, such as documents, images, videos, and music.

How much is the ransom?

The ransom demand varies depending on the victim’s location, and the number of files encrypted. KratosCrypt accepts payment in Bitcoin only.KratosCrypt Ransomware will typically demand between 0.5 and 1.5 Bitcoin.

Should I pay the ransom?

Paying the ransom does not guarantee that you will get your files back. There have been several reports of victims who have paid the ransom but did not receive a decryption key. We do not recommend paying the ransom.

Protection

To protect yourself from KratosCrypt and other ransomware infections, you should take the following precautions:- Keep your operating system and software up to date with the latest security patches.- Avoid opening email attachments from unknown senders. If you must open an attachment from an unknown sender, make sure to scan it with an anti-virus program first.- Use a reputable anti-virus program and keep it up to date.- Back up your important files regularly. This way, if you do get infected with KratosCrypt or any other ransomware, you will be able to restore your files from backup.

What should I do?

If they infected you with KratosCrypt, the first thing you should do is disconnect your computer from the Internet to prevent the ransomware from encrypting any more files.Next, you will need to use a reputable anti-virus program, such as Malwarebytes, to remove KratosCrypt from your computer. You can attempt to remove KratosCrypt manually; however, this is a risky process and should only be attempted by experienced users.Finally, you can restore your files from backup if you have them. If you do not have backups, you may be able to use a data recovery program to recover your files. We recommend using SalvageData data recovery software.

Public decryption tool

Unfortunately, KratosCrypt is new ransomware and there are no public decryption tools available. However, the developers of KratosCrypt may release a decryption tool in the future.

Contact a data recovery service

If you do not feel comfortable removing KratosCrypt from your computer or you are unable to decrypt your files, we recommend that you contact a reputable data recovery service.SalvageData Recovery Services is the only KratosCrypt Ransomware decryption service. We have a success rate of recovering KratosCrypt encrypted files without paying the ransom.

How much does it cost?

The price varies depending on the size of the encrypted data and the level of difficulty.

What is the success rate?

The success rate depends on several factors, including the type of encryption used, the number of files encrypted, and the level of damage to the encrypted files. In general, our success rate is between 70-80%.

How long does it take?

The time required to decrypt KratosCrypt Ransomware encrypted files varies depending on the factors mentioned above. In general, it takes us 1-2 days to decrypt KratosCrypt files.

How to get started?

To get started, you will need to send us a sample of the encrypted KratosCrypt files. We will then analyze the sample and give you a quote for the decryption service.

How do I send you a sample?

To send us a sample, you can use our secure file upload form.

What if I don’t have a sample?

If you don’t have a sample of the encrypted KratosCrypt files, you can send us a list of the file types that were encrypted. We will then be able to give you a quote for the decryption service.

What if I have more questions?

If you have any more questions, you can contact us and we will be happy to answer them.