Emsisoft released a decryption tool for the Hakbit ransomware.
Hakbit is a ransomware that has been heavily reported recently, having affected a large number of users . Most of the victims are from the US and Europe. It affects both companies and ordinary users .
What makes it different from other ransomware is that Hakbit displays the ransom message by changing the victim's desktop wallpaper. It also displays a QR code . Scanning the QR code reveals the attackers' Bitcoin addresses
However, Emsisoft has released a free decryption tool for Hakbit, so that victims can regain access to files .
You can download the decryption tool for free from the official website . According to Emsisoft researchers, Hakbit uses AES-256 encryption and adds the “.crypted” extension to encrypted files. It has also been observed that it tries to change its name to resemble an official file, such as lsass.exe, svchst.exe, crcss.exe, chrome32.exe, firefox.exe, calc.exe.
If the user opens any of these files, Hakbit ransomware will start locking all data. Finally, it will change the desktop wallpaper and display the message, informing victims about the data encryption and the amount of money they need to pay.
According to researchers , the decryption tool will help victims recover all their locked files. They have also included a detailed guide to make it even easier for users.
How to use the decryption tool to recover files affected by Hakbit ransomware?
The decryption of files is done in two stages. In summary:
1) Find the Hakbit decryption key
- Download the decryption tool. You must accept the license terms.
- The first step is to locate the ransom note. The file name is HELP_ME_RECOVER_MY_FILES.txt.
- Then, you click the Start button so the software can download the decryption key.
2) Recover your encrypted files
Next, you need to select the encrypted files as well as the location where they will be stored once decrypted. Click the Start button to begin the recovery process.
It would be a good idea to save your recovered files to an external drive rather than computer . Also, all users should enable Tamper Protection, available in Windows 10 through Microsoft Security, as well as OneDrive Personal Vault , which protects files in the cloud. These solutions offered by Microsoft are very useful in preventing ransomware attacks.
