DarkCrypt Ransomware

The DarkCrypt Ransomware is a file-locking Trojan that imitates the effects of the WannaCryptor Ransomware infections. The DarkCrypt Ransomware includes a functioning encryption method that prevents your media files from opening, as well as a text ransom note. Users should withhold the ransom money, if possible, and let a reliable anti-malware service remove the DarkCrypt Ransomware before they restore from their last backup.

Shedding Light on an Envious Trojan

Overstating the importance of the old '.wcry File Extension' Ransomware or the WannaCryptor Ransomware (also known as merely 'WannaCry') to the threat landscape is challenging. While it isn't an active business, in the same fashion as the Scarab Ransomware or the Globe Ransomware, many threat actors collect its aesthetics and techniques for extortion. The DarkCrypt Ransomware is another imitator to its throne, in the same style as the GottaCry Ransomware, the FilesLocker Ransomware or the Wana Decrypt0r 2.0 Ransomwar.

What the DarkCrypt Ransomware possesses that isn't true of all of the previous Trojans listed above is an authentic encryption feature. This attack will convert PDFs, DOCs, DOCXs, JPGs, and similar media into non-opening, encrypted versions. The Trojan also adds some more superficial changes to the names: separately-bracketed e-mails and IDs, and a 'WannScream!' extension. The ID is one of the shortest strings that malware experts see, relative to the methods in use by most Ransomware-as-a-Services; this difference could help victims with identifying the DarkCrypt Ransomware infections accurately.

Although the DarkCrypt Ransomware also includes a unique ransom note, this text file has little information of interest. It targets English speakers and offers a five-file demonstration of the unlocker, and, as usual, anticipates Bitcoin payments for a full recovery.

Climbing Back Out of the Crypt

The DarkCrypt Ransomware is a Windows program running on .NET Framework, just like the Erica2020 Ransomware or the Turkey-targeting TurkStatik Ransomware. Like them, it also omits any significant features for blocking security solutions or hindering detection by the same. Victims should, however, take care of using an appropriate decryptor, assuming that such software is available. The DarkCrypt Ransomware uses a different encryption method from WannaCryptor Ransomware, and an incompatible decryption attempt can destroy your data permanently.

Documents, pictures, archives, and similarly-common media are the standard targets for the DarkCrypt Ransomware's locking feature. File-locking Trojans like this one are made ineffectual easily by the users saving their work to a second, safer device. While there are recent campaigns explicitly targeting NAS products, malware researchers find no signs of such preferences in the DarkCrypt Ransomware.

As previously noted, most anti-malware programs should detect the DarkCrypt Ransomware, and can remove the DarkCrypt Ransomware infections without problems, for now.

Even though it's less than half a megabyte, the DarkCrypt Ransomware can cause terrible problems for anyone without a responsible data recovery plan. Acting before, rather than after, a disaster always is best – even when it strikes on your hard drive.