What is Rar ransomware?
Rar is a ransomware program, which means it is a virus that makes money to the hacker by holding the victims’ files for ransom. Once on the victim’s computer, it encrypts all the files it can find. These files cannot be opened, edited, or viewed, so they’re virtually useless. However, encryption is a reversible process. Decrypting the files will restore them to their original state; this is exactly what the hacker charges money for.
Rar belongs to the VoidCrypt ransomware family; Eking is an example of another virus in it.
Rar changes the names of the files when it encrypts them; specifically, it adds victim’s unique ID, the hacker’s contact information (an e-mail address), and, finally .rar file extension. This might cause encrypted files to look like archive files, but they’re not. You will not be able to open them with WinRAR or a similar program.
Rar also leaves a ransom note, named simply “Read.txt”. The note itself is rather short and doesn’t contain much information, but you can read it on the image above.
Paying the cybercriminals is not recommended; often, they just disappear after receiving the money. The guide below will explain how to remove Rar ransomware and decrypt .rar files for free, without contacting the hackers.