Ekati Ransomware

Also known as the .encrypted virus, this ransomware threat is not something you want to have to deal with. Like most ransomware, it encrypts files and renames them. This ransomware uses the file extension .encrypted, hence the name. Any encrypted file will receive this new extension and they can’t be opened or used anymore. Ekati also drops a ransom note on the computer. The note details instructions on how a victim can pay the ransom fee to have their files restored.

What does Ekati Do?

Ekati can spread through a number of different means. The most common method of infection is through a payload dropper delivered via spam emails or another social engineering tactic. It can also be spread across social media or file-sharing websites. It could be hidden inside a freeware tool, for example.

The virus works by encrypting files on the computer. It focuses on files in personal folders, such as Documents and Downloads. It can access and encrypt any kind of file once it is on a computer. After the encryption is completed the ransomware displays a splash screen warning users about what has happened and what they can do to get their files back.

Ekati ransom note image

The exact message of the ransom note is as follows:

“Your computer has been encrypted
The hard disks of your computer have been encrypted with a military grade encryption algorithm. It is impossible to recover your data without a special key.
This page will help you with the purchase of this key and the complete decryption of your computers.
Time left: 2d 23h 59m 56s
Click here to start the decryption process”

Security experts recommend that you never pay the ransom demand. The criminals promise that they will return your files to you if you just pay them. There’s no guarantee that they would actually return the files though. There’s also no guarantee that whatever removal tool they give you will really work. The virus could change computer settings so that it always comes back and infects your computer again.