HollyCrypt is malicious software that encrypts your files and demands a ransom for the decryption key.
HollyCrypt Ransomware was first discovered in November 2016.
When HollyCrypt is first executed, it will check for the presence of specific process names. If any of the following processes are running, the HollyCrypt will terminate itself:
– taskmgr.exe
– procexp.exe
– msconfig.exe
– regedit.exe
– gpedit.msc
If HollyCrypt does not detect any of these processes, it will proceed with encryption. HollyCrypt uses the AES-256 encryption algorithm to encrypt files and appends .hbyte to the encrypted filename. For example, a file named 1.jpg would be renamed to 1.jpg.hbyte . HollyCrypt will also create a text file named Read_ME_to_DECRYPT.txt, which contains instructions on how to decrypt your files.
All HollyCrypt ransom notes contain the same text:
All of your important files are encrypted!
Don’t worry, you can still recover your files. To do so, you need to purchase the HollyCrypt Decryption Tool from our website.
The HollyCrypt Decryption Tool costs $500. You can make payment via Bitcoin, Perfect Money, or Paypal.
If you do not pay the ransom within 7 days, the price will double.
In December 2016, HollyCrypt Ransomware targeted a school district in California, encrypting over 10,000 files. The school district ended up paying the ransom and had all their files decrypted.
HollyCrypt Ransomware primarily targets image, audio, video, and document files. However, it will also encrypt other types of files if they are found on the infected system.
Attackers typically spread HollyCrypt through spam emails or fake downloads. To protect yourself from HollyCrypt, we recommend that you avoid opening attachments or clicking links in emails from unknown senders. We also recommend that you download software from reputable sources and avoid using pirated software. Finally, we recommend that you install a reputable anti-malware program and keep it up to date.
If they have infected you with HollyCrypt Ransomware, we do not recommend paying the ransom, as there is no guarantee that your files will be decrypted. Instead, we recommend that you use a reputable anti-malware program to remove HollyCrypt.
HollyCrypt is a difficult virus to remove manually, so we do not recommend attempting to do so.
If you have a backup of your files, you can restore them from the backup. If you do not have a backup, we recommend using data recovery software to recover your files. HollyCrypt Ransomware attempts to delete shadow copies of your files, so data recovery may not be possible in all cases. However, it is worth a try as it may be the only way to recover your files.
You can try SalvageData data recovery software.
Is there a public decryption tool?
At this time, there is no public decryption tool available for HollyCrypt. However, security researchers are working on creating one. We will update this article as soon as a decryption tool becomes available.
SalvageData has been helping HollyCrypt victims recover their data since 2016. We offer a free evaluation to HollyCrypt victims and have a success rate of over 90%.
Contact us for a free consultation.
Recovery mode is a crucial feature for troubleshooting and restoring an iPad when it encounters…
Whether you’re a professional juggling important work documents or an individual cherishing irreplaceable memories, safeguarding…
It's not uncommon to encounter issues where an external drive is not showing up on…
When restoring your iPhone from a backup, you may discover it is corrupted or incomplete.…
Backup and remote wiping procedures are two critical components of data security and management for…
VMware is a leading virtualization and cloud computing software provider. Its core technology allows multiple…