KMA47 Ransomware Authors Demand $100
The KMA47 Ransomware is a weird piece of malware, which works by encrypting the files on the victim's hard drive. However, its creators seem to use the emails that recent variants of the STOP/Djvu Ransomware family use. This is weird considering the fact that KMA47 Ransomware does not belong to the family in question. Instead, it might have been developed from scratch, or it uses code from an unknown file-encryption Trojan.
Whatever the case of KMA47 Ransomware might be, it is still undeniably a very dangerous threat. When it infects a system, it is able to lock the majority of the victim's files by encrypting their contents. These files will be recognizable by the '.encrypt' extension that the threat adds. Just like other file-lockers, this one also aims to spare specific file formats in order to avoid harming the computer's overall functionality. This means that it will skip formats like EXE, DLL, etc.
After the KMA47 Ransomware completes its attack, it creates the 'read_me.txt' ransom note on the desktop. This file lists the addresses manager@mailtemp.ch and helprestoremanager@airmail.cc for contact. Also, it mentions a ransom payment of $100 will be needed to acquire a decryptor. Naturally, the criminals ask for a ransom payment via cryptocurrency like Bitcoin.
You should not trust KMA47 Ransomware's creators. Our advice is to remove the threat with the use of antivirus software, and then explore alternative data recovery options.
