kes$ Ransomware

The kes$ Ransomware is yet another version of the Scarab Ransomware and, sadly, its victims may not be able to use free decryption software to get their files back. The consequences of the kes$ Ransomware’s attack are likely to be very dire since this file-encryption Trojan is able to lock a large portion of the victim’s documents, images, videos, archives, and other potentially important file formats swiftly. There is a chance that the kes$ Ransomware might be targeted towards Russian-speaking users since it drops a ransom note with a Russian name and contents.

All files that the kes$ Ransomware locks will have their extension changed to ‘.kes$’ and the ransomware also may attempt to wipe out the Shadow Volume Copies that may make it more hard for the victim to restore their data. The last step of the kes$ Ransomware’s attack drops the ransom note file ‘Инструкция по расшифровке.TXT,‘ which tells the victims to message kesoma32@horsefucker.org or reserve34@firemail.cc for further instructions.

The attackers are likely to ask the victim to pay them a significant ransom fee via Bitcoin – of course, you should not accept this offer since you may end losing both your money and your files easily. We counsel that you begin the recovery process by using a suitable anti-virus tool to get rid of the threatening program and then try to recover your files from a backup or by using data recovery tools.