Hakbit is another Ransomware that has been reported to infect multiple users, both home and business users. While the majority of the victims are from the US and Europe, it can reach anywhere unless you are careful. What is different about Hakbit is that it displays its demand by changing the victim’s desktop wallpaper. It also shows a QR code. The code, when scanned, reveals attackers’ Bitcoin addresses. If the Hakbit infects you, and your files are locked, Emsisoft has released a free Decryptor for Hakbit.
Free Decryptor for Hakbit Ransomware
The Ransomware Decryptor Tool is free, and you can download it from the official website. According to Emsisoft, Hakbit uses AES-256 encryption and names the files with the extension “.crypted. It also attempts to change its name to an official file like lsass.exe, svchst.exe, crcss.exe, chrome32.exe, firefox.exe, calc.exe. If the user launches any of these files, it will start locking down the data and then change the wallpaper to display the message asking for demand.
The decryption tool can help you recover all your locked files. The developers have put up a detailed user guide if you find it complex to use.
How to decrypt files locked by Hakbit
It’s a two-phase process. The first phase finds the key, and the second phases use the key to decrypt the files.
1] Find Hakbit Decryption key
- Download the application and launch it as an administrator. You will have to agree to the license terms to use this tool.
- The first step is to locate the ransom note. The name of the file is HELP_ME_RECOVER_MY_FILES.txt. The file is available in the primary partition.
- Click on start so the software can figure out the decryption key.
- Once found, it will display the message about the same. If you want, note down the key somewhere safe.
2] Recover Files decrypted by Hakbit
- Next, you need to select the file or add a location which has been encrypted, and a location to save the file once its decrypted.
- Click on the start button to initiate the recovery process.
- The decryptor will display the reconstructed encryption details once the recovery process has
finished.
I would recommend you to copy the files into an external drive than keeping it on the same computer. Ransomware is the primary reason why you need to enable Tamper Protection available to everyone in Windows 10 through Microsoft Security. Microsoft also offers OneDrive Personal Vault to help you protect files on the cloud.
