Killer Ransomware

Computer users may be infected by the Killer Ransomware when they download pirated games, fake security applications, visit corrupted websites or click on misleading advertisements and content. Downloads from unknown sources and clicks on advertisements that appear out of nowhere are extremely risky and avoiding them can minimize the chances of encountering threatening files. Another method often used by ransomware creators to infect targeted machines is spam emails containing fake messages, which may ask users to view a document or attachment that, in reality, is the trigger for the infection.

To mark the files it encrypts, the Killer Ransomware will append the '.kill' suffix at the end of their names. When the file encryption is complete, the Killer Ransomware will then display its ransom note, which is contained in a file named '#FILES-ENCRYPTED.txt'.

The ransom note presented by the Killer Ransomware reads:

'!!!All of your files are encrypted!!!
To decrypt them send e-mail to this address: crypter@firemail.de
In case of no answer in 24h, send e-mail to this address: crypter1help@cyberfear.com
Your System ID : -
!!!Deleting "RSA.-.kill" causes permanent data loss.

*Pay attention*

Your system security is very poor, All your files and information are locked.
This is an error on your part We can solve your problem.
But you have to pay us to restore the files.

$$We set the price according to the economic conditions of your country$$

 Do not worry about the amount, we can agree in any case.
Email us to reach an agreement.

*The later you send us an email, the more money we will receive*

Hurry up if you want unlock files, because the malware will start deleting the files after a while.
Please do not edit the files, you may lose them forever.

*Pay attention*

#If files are really important for you.
Send us an email soon.

$$We consider the economic and financial situation of you and your country and then say the amount$$

Do not worry, we can reach definitely agree with you.
The payment method is bitcoin.
If you do not trust us we can prove that we can restore the files To do this, send us a file of less than five megabytes Until we restore it Until you trust us.

 +read carefully:

#Do not edit files You may lose them forever.

#Do not worry about the amount, we can reach an agreement.

#The payment method is bitcoin.

#Send us 3 files if you want to make sure we can restore your files.

+Ways to contact us:

Our Email:
crypter@firemail.de
crypter1help@cyberfear.com

Your System ID: -'

As we can see, the attackers do not mention the amount they want to be paid as a ransom. Instead, they provide two email addresses that should be used to contact them. However, the victims of ransomware attacks should keep in mind that they are dealing with criminals so contacting them or paying the ransom should be avoided at all costs. The recommended response to a ransomware attack is to remove the threat from the affected machine and look for a free decryptor online.