Bitdefender Releases Decryptor for MortalKombat Ransomware

A new decryptor for the MortalKombat ransomware is now available for download. Bitdefender has been monitoring the MortalKombat ransomware family since it first appeared online in January this year.

Based on the Xorist ransomware, MortalKombat spreads through phishing emails and targets exposed RDP instances. The malware gets planted through the BAT Loader that also delivers the Laplas Clipper malware. An in-depth description of the ransomware is available in this  Cisco Talos blogpost.

Signs of infection

Once executed, MortalKombat Ransomware encrypts data and generates files with a specific extension: ..Remember_you_got_only_24_hours_to_make_the_payment_

if_you_dont_pay_prize_will_triple_Mortal_Kombat_Ransomware. It also changes the desktop wallpaper to give it a Mortal Kombat theme and generates a ransom note called HOW TO DECRYPT FILES.txt.

Free decryptor to the rescue

Bitdefender has released a free universal decryptor for the current version of MortalKombat, available below:

Download the MortalKombat decryptor

The tool can also be executed silently via a command line. If you need to automate deployment of the tool inside a large network, you might want to use this feature.

• -help - will provide information on how to run the tool silently (this information will be written in the log file, not on console)
• start - this argument allows the tool to run silently (no GUI)
• -scan-path - this argument specifies the path containing encrypted files

• -full-scan - will enable the Scan entire system option (ignoring -scan-path argument)

• -disable-backup - will disable the file Backup option

• -replace-existing - will enable the Replace previously decrypted files option

Examples:

• BDMortalKombatDecryptTool.exe start -scan-path:C:\ -> the tool will start with no GUI and scan C:\
• BDMortalKombatDecryptTool.exe start -full-scan -> the tool will start with no GUI and scan entire system
• BDMortalKombatDecryptTool.exe start -full-scan -replace-existing -> the tool will scan the entire system and overwrite present clean files.