Types header

Keyholder Ransomware

Name KeyHolder
Type Crypto Ransomware
Encryption Type Immensely strong RSA-2048 encryption algorithm
Short Description The ransomware encrypts all the files with the XOR cipher and uses CFB mode and asks a ransom payment of 500$ for decryption.
Symptoms Files are encrypted and becomes inaccessible. A ransom note with instructions for paying the ransom shows as .txt and .html files.
Distribution Method Spam Emails, Email Attachments, File Sharing Networks.
Image  KeyHolder
More Details

After infection, the KeyHolder crypto-virus immediately drops a malicious file on the victim PC. The file may be dropped in various Windows directories, for example:

  • %AppData%
  • %Roaming%
  • %Local%
  • %Temp%
  • %Program Files%
  • %Windows%
  • %User`s Profile%

After this, KeyHolder ransomware immediately begins scanning the infected computer for the most widely used file extensions and encrypt them on a random basis. Some of the extensions KeyHolder ransomware may encode are the following:

→ “PNG .PSD. PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”

After encryption, when an encoded file is opened, Windows does not recognize it and looks for a program to open it. The ransomware uses a XOR cipher along with a so-called CFB mode which additionally secures the encrypted files and makes direct decryption a rather risky process.