Korean Ransomware

With the prevalence of ransomware programs worldwide, it is no surprise that there are also regional varieties. Korean Ransomware is a malicious infection that mostly affects computer users in South Korea, although it is quite possible to get infected with it no matter where you might live. If you frequent the Korean websites that might be responsible for distributing this infection, it is only natural that you have a chance to get infected with it. When that happens, you need to do everything in your power to remove Korean Ransomware from your computer, and in this description, we will tell you how to do that.

The most peculiar thing about this infection is that it should encrypt your files, but the samples we have acquired do not. What does it mean? It may mean that the program has not been fully developed yet, or it is just a test run for some future infection. On one hand, it means that it is a lot easier to deal with Korean Ransomware than we would have expected, on the other hand, you should not put your guard down because there is always something more dangerous lurking behind the corner. You can never know when an extremely malicious threat may enter your PC!

Our research team says that the website for this program is located at t352fwt225ao5mom.onion. Does it mean that you can download this program whenever you want? Not necessarily. This program may look like Ransomware-as-a-Service, but it is not available out in the open. The program can only be accessed via the TOR network, so only people who are used to darknet can get their hands on this application. What’s more, Korean Ransomware is based on the Project Hidden Tear. It is an open source for ransomware creators. Basically, you have a code given to you, and you can create your own infection out of that.

Although Hidden Tear project has been abandoned ever since, some of the programs based on it are still out there. For example, the web server used by Korean Ransomware is identical to the one that is employed by CrypMIC Ransomware and Microsoft Decryptor Ransomware. So, it is easy to see that this application belongs to a group of similar ransomware infections, and so it proves just how big the malware network is. Unfortunately, it does not give us any clue about how we should deal with this infection because each ransomware is different.

Nevertheless, we have already mentioned that Korean Ransomware does not (or cannot, in this case) encrypt your files. Perhaps we should mention that it should affect a list of file types, including .txt, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .odt .jpg, .png, .csv, .sql, .mdb, .hwp, and others. Thus, it would not be surprising if another version of this application came and successfully blocked you from accessing your files. The affected files should have the .암호화됨 extension, which means “encrypted” in Korean. Based on the program’s setup, it should be using the AES encryption algorithm, and it would make it virtually impossible to decrypt your files without the original decryption key.

However, we reach another side of this scam. It goes without saying that Korean Ransomware and similar programs enter target computers because of money. They will try to force innocent users into spending their money on supposed decryption keys. In some cases, it might seem that paying the criminals behind this attack is your only option to get your files back. Nevertheless, security experts unanimously say that succumbing to these demands is definitely not the way to go.

If Korean Ransomware did not encrypt your files, you should remove the file you had launched before the ransomware’s message popped into your screen. If it did affect your data, you have to remove Korean Ransomware immediately and then restore your files from an external backup. It might also be possible to restore your files from Shadow Volume Copies, provided the ransomware did not delete those upon the installation. However, that would require some help from a computer specialist.

The best way to terminate this infection is investing in a licensed antispyware tool. There might be some files and various registry entries, associated with the infection, that are hard to spot on your own. If you make use of a powerful antispyware tool, all of that will be taken for you automatically.

How to Remove Korean Ransomware

1. Open your Downloads folder.
2. Delete the last opened Kakao Talk file.
3. Run a full system scan with the SpyHunter free scanner.