KeRanger Ransomware Data Recovery

What is KeRanger Ransomware?

KeRanger is ransomware that was discovered on March 4, 2016. This ransomware will encrypt your files and demand a ransom to decrypt your files. KeRanger is the first ransomware that has been found in a legitimate Mac App Store application. The application that KeRanger was found in was called Transmission, which is a free and open-source BitTorrent client.

How does KeRanger work?

When this ransomware is installed on your computer, it will wait for three days before it starts to encrypt your files. KeRanger uses AES-256 encryption, which is a very strong type of encryption. Once KeRanger starts to encrypt your files, it will add the “.locked” extension to all of your encrypted files. For example, “sample.jpg” would become “sample.jpg.locked”. It will also create a text file named “README_FOR_DECRYPT.txt” in each folder that contains encrypted files. This text file will contain KeRanger’s ransom demand.

KeRanger Ransomware demands

KeRanger’s ransom demand is currently set at 1 Bitcoin. KeRanger tells victims that they have 7 days to pay the ransom or else the price will double. KeRanger also states that if victims do not pay the ransom within 30 days, it will permanently delete their files.

What types of files does KeRanger encrypt?

It will encrypt almost all types of files on your computer. This includes documents, pictures, music, videos, and more. The only types of files that KeRanger will not encrypt are system files and files in the Mac App Store application folder.

Protection

The best way to protect yourself from KeRanger Ransomware is to have a good backup plan. This way, if KeRanger or any other ransomware encrypts your files, you will be able to restore them from your backups. You should also make sure that you have a good antivirus program installed on your computer. Also, KeRanger Ransomware is currently being distributed through the Transmission BitTorrent client. So, if you do not use this program, you are not at risk of getting this ransomware. KeRanger is also being spread through pirated versions of popular software programs. So, you should always make sure that you download software from trustworthy sources.

What should I do?

If KeRanger has already encrypted your files, you should not pay the ransom. This is because there is no guarantee that KeRanger will decrypt your files even if you do pay the ransom. Also, by paying the ransom, you would be encouraging KeRanger’s creators to continue their illegal activities.

How to remove KeRanger Ransomware?

If KeRanger has encrypted your files, you should use a reputable anti-malware program to remove KeRanger and decrypt your files. We recommend using SpyHunter or Malwarebytes. These programs can detect and remove this ransomware as well as other malicious programs that may be installed on your computer.

Is there a public decryption tool?

There is not currently a public decryption tool for KeRanger Ransomware. However, the KeRanger Ransomware creators may release a decryption tool in the future.

How to recover KeRanger encrypted files?

You can try to use data recovery software to recover your files. This may work if it has not encrypted your files completely. We built SalvageData data recovery software to help you.

If you cannot decrypt your files using data recovery software, you may be able to use a professional decryption service. These services can decrypt KeRanger Ransomware files for a fee. However, you should only use a reputable decryption service. We recommend using SalvageData Recovery Services.

Since 2003, SalvageData has been recovering data for businesses, individuals, and government entities with over a 96.7% success rate. We salvage data when others cannot. Contact us at 877-440-3282 for a free consultation.