{"id":10359,"date":"2018-02-09T10:36:01","date_gmt":"2018-02-09T15:36:01","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/cryakl-decrypted-for-good\/10359\/"},"modified":"2020-02-26T19:00:05","modified_gmt":"2020-02-26T15:00:05","slug":"cryakl-decrypted-for-good","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/cryakl-decrypted-for-good\/10359\/","title":{"rendered":"Cryakl\/Fantomas victims rescued by new decryptor"},"content":{"rendered":"

The No More Ransom project for assisting victims of ransomware has good news to report: The Belgian police, in cooperation with Kaspersky Lab, managed to obtain keys for recovering files encrypted<\/a> with new versions of Cryakl ransomware, also known as Fantomas. The updated decryption tool is already available on the project\u2019s website<\/a>.<\/p>\n

\"How<\/a><\/p>\n

What is Cryakl?<\/h2>\n

The Trojan ransomware Cryakl (Trojan-Ransom.Win32.Cryakl) has been . At first, it was distributed through attached archives in e-mails that appeared to come from an arbitration court in connection with some alleged wrongdoing. There is something about such messages that sets nerves to jangling, and even those who know better might be inclined to click on the attachment. Later, the e-mails diversified, looking like messages from other organizations, such as a local homeowners\u2019 association.<\/p>\n

When encrypting files on a victim\u2019s computer, Cryakl creates a long key that it sends to a command-and-control C&C server. Without this key, it is nearly impossible to recover files impacted by the malware. After that, Cryakl replaces the desktop wallpaper with contact details for its creators together with a ransom demand. Cryakl also displays an image of the mask of the 1964 French movie villain Fantomas, hence its alternative name. Cryakl mostly targeted users in Russia, so information about it is mostly available in Russian.<\/p>\n

Ransomware\u2019s history and evolution in facts and figures<\/a><\/p><\/blockquote>\n