Bat Ransomware

The infamous Dharma Ransomware family continues to expand with the addition of new variants like the Bat Ransomware. Having your files locked by this variant of Dharma is likely to end poorly for you due to the lack of free decryption options. The only full recovery option appears to be offered by the threat’s authors, but they may want to receive a hefty compensation in exchange for their help. Of course, cooperating with anonymous cybercriminals is out of the question, and you should not agree to send money to the Bat Ransomware’s authors.

Users may be exposed to the threatening Bat Ransomware when they open a corrupted file attachment that was disguised as a legitimate document – this is one of the most commonly used social engineering tricks to propagate file-lockers like this one. Once the Bat Ransomware is initialized, it may need just a few minutes to fulfill its purpose and encrypt numerous documents, images, text files, videos, songs, spreadsheets, archives, and other common file formats found on the victim’s hard drive.

The Bat Ransomware marks the names of the encrypted files with the ‘.id-.[idecryptyourdata@cock.li].bat’ extension. However, this email is not the only one used by the attackers, since their ransom note also provides the alternative email decryptyourdata@qq.com.

As we mentioned earlier, you should not agree to message the perpetrators since they will only help if you send them money. The advice is to rely on trustworthy software for the recovery – start by using an anti-virus tool to eliminate the threat, and then try the services of data recovery software.