KawaiiLocker is a type of ransomware that encrypts your files and demands a ransom to decrypt them.

History

This ransomware was first discovered in August 2019. It is written in the Go programming language and targets Windows systems.The biggest outbreak of KawaiiLocker Ransomware occurred in September 2019. At that time, the ransomware was being distributed via phishing emails that pretended to be from DHL. The email claimed that the recipient had a package waiting for them and included a malicious attachment that, when opened, would encrypt the victim’s files.KawaiiLocker Ransomware is notable for its use of the “kawaii” Japanese aesthetic, which includes images of popular anime and video game characters. The ransomware also uses this aesthetic in its ransom note, which is written in broken English and instructed victims to contact the attackers via an email address written in katakana.

How does KawaiiLocker Ransomware work?

When KawaiiLocker is executed, it will check to see if the victim is using a virtual machine. If they are, KawaiiLocker Ransomware will not encrypt their files.This ransomware will then create a unique ID for the victim and generate an RSA-2048 key pair. The public key will be used to encrypt the victim’s files and the private key will be used to decrypt them.The ransomware will then scan the victim’s hard drive for certain file types and encrypt them using the AES-256 encryption algorithm. It will also add the “.kawaii” extension to any files that it encrypts.Once KawaiiLocker has encrypted the victim’s files, it will display a ransom note that instructs the victim on how to contact the attackers and pay the ransom.

Ransom note:

Your files have been encrypted!To decrypt your files, you need to buy a decryption key.The price of the key depends on how quickly you contact us.If you don’t contact us within 48 hours, the price will double.If you don’t contact us within 72 hours, your files will be permanently lost.

Payment methods

This ransomware accepts payments in Bitcoin and Monero.

Ransom amount

The ransom for KawaiiLocker starts at 1 Bitcoin and increases if the victim does not contact the attackers.

What types of files does KawaiiLocker encrypt?

It will encrypt any file type that it comes across. However, it is known to target certain types of files, such as:-Documents (e.g., .docx, .pdf)-Images (e.g., .jpg, .png)-Audio files (e.g., .mp3, .wav)-Video files (e.g., .mp4, .avi)-Database files (e.g., .SQL, .accdb)

Protection

To protect yourself from KawaiiLocker and other types of ransomware, you should:- Use a reputable anti-virus program.- Keep your operating system and software up-to-date.- Don’t open email attachments from unknown senders. Attackers often distribute ransomware via phishing emails.- Don’t click on links in emails from unknown senders. These links could lead to websites that infect your computer with ransomware.- Backup your files regularly. This way, if you do get infected with ransomware, you can restore your files from a backup.

What should you do?

If attackers have infected you with KawaiiLocker, you should:- Do not pay the ransom. There is no guarantee that you will get your files back even if you do pay, and you would be supporting the attackers’ illegal activity.- Use a reputable anti-virus program to remove it.- Restore your files from a backup if you have one.- Contact a computer professional for help. SalvageData Recovery Services can help you recover your files.

How SalvageData can help?

SalvageData has successfully recovered data from KawaiiLocker and other types of ransomware. We have a team of certified recovery engineers who are available 24/7 to help you recover your data. Call us now at +1 (800) 972-3282 for a free consultation.