Tag: .eking file extension

What is Eking ransomware?

Eking is a ransomware program, called this way because it infects victims’ computers and holds their files out for ransom. This virus belongs to the VoidCrypt ransomware family (do not confuse it with Eking ransomware of the Phobos family).
“How did my files get stolen?”, you might ask. The answer is pretty simple. You might know that certain programs allow you to put a password on your files, making them inaccessible without that password. Ransomware programs do essentially the same, except they don’t ask you for password. Only the hacker behind the program knows it. The ransom involves selling the victim said password, usually referred to as “encryption key” as this is the technical term. Locking the files, meanwhile, is referred to as “encrypting” them.
Eking does more than just encrypt the files, though. To communicate the demands to the victim, it leaves a ransom note, named “INFO.txt”, on the Desktop. The full text is shown on the image above, but basically, it only contains contact information. The virus also renames the files it encrypts. A victim’s ID, the hacker’s contact information, and finally .eking file extension get added to the name of the file.
Hackers behind ransomware will often ignore the victims after they get paid, so we wrote a guide that explains how to remove Eking ransomware and decrypt .eking files without getting in contact with them.