If you found your files encrypted by Hydracrypt, then this article is just for you. Read the guide below on how to decrypt Hydracrypt files for free.
This is yet another trojan-ransomware infection that has been active since January 2016 and targets all Windows operating systems. The Hydra was a mythical beast with nine serpent heads, and if one was successfully cut off, another would immediately grow in its place. This is like ransomware – when one damn cryptogram is cracked, the monster grows another head immediately. It is interesting to note that the artwork the hackers have appropriated for their logo is from a comic book depicting a skull with SIX tentacles – perhaps they don’t teach children the Classics anymore, or perhaps it merely reflects the level of these criminals’ intelligence.
This ransomware is similar to several that have preceded it. It is malware that infects, installs in the Windows directory, then contacts a command and control server to report that it’s in and running. As this takes place, the encryption begins of all files (except system files) including system backup files and even the contents of the Recycle Bin. As the data that’s encrypted also includes application settings and files that contain stored passwords, any automatic log-in details will be useless. After this is complete, the user receives a demand for money in return for the decryption key, with a time limit of 72 hours. The price rises if the victim doesn’t pay within the demanded time. If the ransom is not paid, the criminals state, then all encrypted files ‘… will be sold on the Dark Markets’ – this is why it’s vital to detect HydraCrypt and deal with it before encoding is completed.
The trojan is usually introduced by a link to a malware download ‘site where infection takes place, or via an attachment in a spam ‘mail that when opened starts a self-install sequence. Increasingly, these spam e-mails are becoming more targeted (to a user’s nationality) and more convincing, often mocked-up to be from a government tax department, a well known courier service or local authorities concerning a parking violation. The text on the ransom demands is often an automatic/ second language translation that is poorly spelled, though by the time you see one of these, it’s too late. In contrast, the e-mail delivery method the trojan is using becomes even more precise in language and local information and social engineering to seem ever more convincing; so be careful and avoid HydraCrypt.
How to detect and deal with Hydracrypt?
As the ransomware is designed to be capable of evading all but the most efficient analysis, it is important for the user to note and take action on any profound changes in system behavior. The vital thing as far as file recovery is concerned, is to detect and disrupt the encryption process before it is completed. Due to the comprehensive number of target files, CPU usage during the activity of the malware goes up to around 70% during encryption, so should bring about significant slowing of the operating system. This may be accompanied by momentary freezing of the screen and open programs unexpectedly crashing. If these symptoms are noticed, immediately disconnect from the internet and network connections – wired and wireless. Check in files for any changes of extensions – if .HydraCryptxxxxx or anything similar are present, the next job is to backup all undisturbed files to an external device and then to destroy HydraCrypt. If you have already backed-up your files to an external medium recently (like Cloud storage), then a simple option is to reformat your disk and re-instal. If not, then the trojan has to go before any attempt is made to recover encrypted files; details on how to uninstall HydraCrypt follow.
After dispatching the beast, there are several ways to try to recover lost data, the first being a full System Restore to a previous point in operating memory. If this doesn’t recover all the data, then the next thing to try is in Previous Versions using either Microsoft system tools or data-recovery software like R-Studio, or Photorec. If this step is not successful, then the last option is to search in Shadow Volume Files using Shadow Explorer (available from windows.microsoft.com).
How to decrypt HydraCrypt encrypted files?
Please, follow as strictly as possible the steps below in order to successfully decrypt HydraCrypt files:
Step 1: Download the free Hydracrypt decrypter from here: http://emsi.at/DecryptHydraCrypt.
Step 2: This step is important. You must find one encrypted file and his original. Without this, the decrypter will not be able to determine the correct decryption key for your system. Once you found the paid of files, select both of them, drag them and drop them on decrypt_hydracrypt.exe file.
Step 3: The decrypter will start determining the unique encryption key for your system. Please, be very patient, since this can be rather time consuming process and depending on your CPU and system can take up to several days!
Step 4: Once the decrypter find the unique encryption key, a window like those below will open.
Step 5: Click OK button , then Add folders with the encrypted files on the screen after.
Step 6: Click Decrypt button. Wait, until the HydraCrypt decrypter finishes decrypting all your encrypted files.
How to prevent HydraCrypt?
It is only diligent set-up and careful working practices that are required to stop HydraCrypt from entering a system. If the user prepares defences to block the ingress of malware, then browses and installs hygienically with potential risks in mind, this many-headed reptile won’t get near. First secure all the doors: ensure your browser is current and keep it updated – turn all security settings to full; make sure that your system is not lacking any patches and regularly check for updates; find out about system Administrator and Privileges to secure unauthorized path and port usage in the system (for instance, this can stop some trojans reporting back to the C&C server and so stop their activation); ensure that all wireless and wired connections and networks and secure, and disable Remote Desktop Protocol if unused.
Get the best firewall you can to put around your system. If the doors are all closed, and security is in place, the only other requirement is to be alert and remember not to create a back-door by inattentive practice. Oh, and by the way – after a long battle, Hercules finally slew the Hydra!
