What is Kupidon Ransomware
Kupidon is a type of crypto-malware that popped up on 5th May 2020. This ransomware encrypts a variety of files including images, ZIP archives, text files, documents, and other regular data. To highlight them from original files, it adds the .kupidon extension at the end of each file. For example, 1.mp4 that was previously non-encrypted, will be retitled to 1.mp4.kupidon after encryption. After successful encryption, the virus drops a text file called !KUPIDON_DECRYPT.txt that reflects ransom information.
All your files have been encrypted with Kupidon Virus.
Your unique id: 72E4D50643044F7D908AF89F7326B0FB
As a private person you can buy decryption for 300$ in Bitcoins.
But before you pay, you can make sure that we can really decrypt any of your files.
The encryption key and ID are unique to your computer, so you are guaranteed to be able to return your files.
To do this:
1) Download and install Tor Browser ( https://www.torproject.org/download/ )
2) Open the http://oc3g3q5tznpubyasjgliqyykhxdfaqge4vciegjaapjchwtgz4apt6qd.onion/ web page in the Tor Browser and follow the instructions.1) Send a few encrypted files (no more 3 files, no more 10 MB per file) to ann4.orlova.892@yandex.ru . Dont forget to include you ID from !KUPIDON_DECRYPT.TXT.
2) We will decipher them and send you back with bitcoin address for payment.
3) After payment ransom for Bitcoin, we will send you a decryption program and aes-key with instructions. If we can decrypt any of your files, we have no reason to deceive you after payment. In order to get your files back, you should make a very harsh decision – pay 1200$ (for commercial users) or 300$ (for regular) in BTC which is not affordable for many people. To finish the payment, you are asked to open the attached link in the Tor browser and follow on-screen instructions. Whatever the case, it is risky to trust cybercriminals and pay a ransom, especially when it exceeds all the limits. Kupidon Ransomware also uses a crafty trick – it allows users to decrypt up to 3 files (not more than 10MB) by sending it to their e-mail. Unfortunately, free decryption is not available at this moment, however, security experts give their best to find a way to unlock files affected by Kupidon. For now, we recommend you delete Kupidon Ransomware to prevent further encryption.
How Kupidon Ransomware infected your computer
Crypto malware (ransomware) is usually distributed via multiple vectors – e-mail spam messages with malicious attachments, exploit kits, software cracks, fake activators for Windows/its products, trojans, exploiting remote monitoring and managing (RMM) software, RDP bruteforce attacks, and others. Kupidon has been effectively attacking physical servers by abusing weak connections and passwords. To be sure about safety against ransomware threats, you should be careful around the web, do not open unknown content and other fields that seem to be suspicious. Always think twice before committing to the download of any pirated or cracked program since they can be infected with ransomware. Our guide below will help you get answers to most common questions and help you delete Kupidon Ransomware from your computer.
- Download Kupidon Ransomware Removal Tool
- Get decryption tool for .kupidon files
- Recover encrypted files with Stellar Data Recovery Professional
- Restore encrypted files with Windows Previous Versions
- Restore files with Shadow Explorer
- How to protect from threats like Kupidon Ransomware
Download Removal Tool
To remove Kupidon Ransomware completely, we recommend you to use SpyHunter 5 from EnigmaSoft Limited. It detects and removes all files, folders, and registry keys of Kupidon Ransomware. The trial version of SpyHunter 5 offers virus scan and 1-time removal for FREE.
Alternative Removal Tool
To remove Kupidon Ransomware completely, we recommend you to use Norton Antivirus from Symantec. It detects and removes all files, folders, and registry keys of Kupidon Ransomware and prevents future infections by similar viruses.
Kupidon Ransomware files:
!KUPIDON_DECRYPT.TXT
{randomfilename}.exe
Kupidon Ransomware registry keys:
no information
How to decrypt and restore .kupidon files
Use automated decryptors
Download Kaspersky RakhniDecryptor
Use following tool from Kaspersky called Rakhni Decryptor, that can decrypt .kupidon files. Download it here:
There is no purpose to pay the ransom because there is no guarantee you will receive the key, but you will put your bank credentials at risk.
Dr.Web Rescue Pack
Famous antivirus vendor Dr. Web provides free decryption service for the owners of its products: Dr.Web Security Space or Dr.Web Enterprise Security Suite. Other users can ask for help in the decryption of .kupidon files by uploading samples to Dr. Web Ransomware Decryption Service. Analyzing of files will be performed free of charge and if files are decryptable, all you need to do is purchase a 2-year license of Dr.Web Security Space worth $120 or less. Otherwise, you don’t have to pay.
If you are infected with Kupidon Ransomware and removed it from your computer you can try to decrypt your files. Antivirus vendors and individuals create free decryptors for some crypto-lockers. To attempt to decrypt them manually you can do the following:
Use Stellar Data Recovery Professional to restore .kupidon files
- Download Stellar Data Recovery Professional.
- Click Recover Data button.
- Select type of files you want to restore and click Next button.
- Choose location where you would like to restore files from and click Scan button.
- Preview found files, choose ones you will restore and click Recover.
Using Windows Previous Versions option:
- Right-click on infected file and choose Properties.
- Select Previous Versions tab.
- Choose particular version of the file and click Copy.
- To restore the selected file and replace the existing one, click on the Restore button.
- In case there is no items in the list choose alternative method.
Using Shadow Explorer:
- Download Shadow Explorer program.
- Run it and you will see screen listing of all the drives and the dates that shadow copy was created.
- Select the drive and date that you want to restore from.
- Right-click on a folder name and select Export.
- In case there are no other dates in the list, choose alternative method.
If you are using Dropbox:
- Login to the DropBox website and go to the folder that contains encrypted files.
- Right-click on the encrypted file and select Previous Versions.
- Select the version of the file you wish to restore and click on the Restore button.
How to protect computer from viruses, like Kupidon Ransomware, in future
1. Get special anti-ransomware software
Use ZoneAlarm Anti-Ransomware
Famous antivirus brand ZoneAlarm by Check Point released a comprehensive tool, that will help you with active anti-ransomware protection, as an additional shield to your current protection. The tool provides Zero-Day protection against ransomware and allows you to recover files. ZoneAlarm Anti-Ransomware is compatible with all other antiviruses, firewalls, and security software except ZoneAlarm Extreme (already shipped with ZoneAlarm Anti-Ransomware) or Check Point Endpoint products. The killer features of this application are: automatic file recovery, overwrite protection that instantly and automatically recovers any encrypted files, file protection that detects and blocks even unknown encryptors.
2. Back up your files
As an additional way to save your files, we recommend online backup. Local storages, such as hard drives, SSDs, flash drives or remote network storages can be instantly infected by the virus once plugged in or connected to. Kupidon Ransomware uses some techniques to exploit this. One of the best services and programs for easy automatic online backup is iDrive. It has the most profitable terms and simple interface. You can read more about iDrive cloud backup and storage here.
3. Do not open spam e-mails and protect your mailbox
Malicious attachments to spam or phishing e-mails is most popular method of ransomware distribution. Using spam filters and creating anti-spam rules is good practice. One of the world leaders in anti-spam protection is MailWasher Pro. It works with various desktop applications, and provides very high level of anti-spam protection.
