Kifr Ransomware Increases Ransom Amount After 72 Hours

During our analysis of malware samples, our researchers discovered Kifr ransomware, a variant of the Djvu family. Like other ransomware, Kifr encrypts files and adds the ".kifr" extension to their names. The ransomware also creates a "_readme.txt" file, which contains instructions on how to pay the ransom.

For instance, if a file is called "1.jpg", Kifr will rename it to "1.jpg.kifr". It's possible that Kifr is being distributed alongside other types of malware, such as RedLine or Vidar, which are known for stealing information.

The ransom note instructs victims to contact the attackers through support@freshmail.top or datarestorehelp@airmail.cc to retrieve their encrypted files. The note also includes payment instructions and urges victims to contact the attackers within 72 hours to receive a 50% discount on the decryption software and key. The usual cost of these tools is $980.

Additionally, the ransom note suggests that victims can submit a single encrypted file for free decryption to confirm that the attackers are capable of decrypting the files. However, victims should be cautious when dealing with cybercriminals and paying ransoms, as there is no guarantee that they will receive the promised decryption tools or that their files will be restored even after payment.

Kirf Ransom Note Increases Ransom to $980 After 3 Days

The full text of the Kifr ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-lEbmgnjBGi
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Fils from Ransomware Like Kifr?

There are several steps you can take to protect your files from ransomware like Kifr:

• Regularly backup your important files: Back up your files regularly to an external hard drive or cloud storage service. This way, if your files are encrypted by ransomware, you can simply restore them from the backup.
• Keep your operating system and software up-to-date: Regularly update your operating system and software to patch any security vulnerabilities that may be exploited by ransomware.
• Use a reputable antivirus software: Install and use a reputable antivirus software that can detect and prevent ransomware attacks.
• Be cautious of suspicious email attachments and links: Be careful when opening email attachments or clicking on links from unknown or suspicious sources. Ransomware can often be delivered through email attachments or links.
• Enable pop-up blockers: Enable pop-up blockers on your browser to prevent malicious pop-ups and ads.
• Limit user privileges: Limit user privileges to prevent ransomware from spreading to other parts of your system.