Screenshot of the contents of ‘_readme.txt’ file (Koom ransom note) It encrypts file by file, when all the files in the directory are encrypted, it drops a new file in the directory, which is called ‘_readme.txt’. Therefore, files located in network attached storage and external devices can also be encrypted. Koom virus can encrypt files located on all drives connected to the computer. If the file was called ‘document.docx’, then after encryption, it will be named ‘’. vfs0Įach file that has been encrypted will be renamed. Thus, the following common file types can be easily encrypted:

Koom has the ability to encrypt files of any type, regardless of what is in them. This key is the same for any victims, which makes it possible in some cases to decrypt files that were encrypted during the ransomware attack. If the virus cannot establish a connection with its command and control server (C&C) before starting the encryption process, then it uses an offline key. For each victim, Koom uses a unique key with a small exception. This virus encrypts files using a strong encryption method, which eliminates the possibility of finding a key in any way. Like other variants, it encrypts all files on the computer and then demands a ransom for decryption. Koom ransomware is a malware which is a new variant of STOP ransomware. For more information visit follow us on LinkedIn, Facebook and Twitter.Screenshot of files encrypted by Koom virus (‘.koom’ file extension) QUICK LINKS The company has a global sales network covering more than 200 countries and territories, and regional offices in Bratislava, San Diego, Singapore and Buenos Aires.

Its broad security product portfolio covers all popular platforms and provides businesses and consumers around the world with the perfect balance of performance and proactive protection. Since 1987, ESET® has been developing award-winning security software that now helps over 100 million users to Enjoy Safer Technology. Note: New variants of this ransomware family may use new keys, making the affected files un-decryptable. If you need additional information on how to use the tool, please refer to ESET Knowledgebase. If you have been a victim of Crysis ransomware, you can find and download the ESET Crysis decryptor from our free utilities page. Spreading via multiple channels, it has been detected by our systems thousands of times all over the globe. The Crysis malware family began gaining prominence after one of its main “competitors”, TeslaCrypt, ceased operations earlier this year. The tool was prepared using the master decryption keys, recently released via a forum at. ESET has prepared a free decryptor for ransomware victims, offering a helping hand to anyone whose data or devices have been hit by the Crysis family (detected by ESET as Win32/Filecoder.Crysis).

Ransomware decryptors