أخبار ساخنة

MortalKombat ransomware decryptor

MortalKombat ransomware

Cybersecurity company Bitdefender has released a free universal decryptor for a nascent file-encrypting malware known as MortalKombat.

MortalKombat is a new ransomware strain that emerged in January 2023.

It's based on a commodity ransomware dubbed Xorist and has been observed in attacks targeting entities in the U.S., the Philippines, the U.K., and Turkey.

A decryptor for Xorist was made available by Emsisoft in May 2016.

MortalKombat notably was deployed in recent attacks mounted by an unnamed financially motivated threat actor as a part of a phishing campaign aimed at a wide range of organizations.

MortalKombat encrypts various files on the victim machine's filesystem, such as system, application, database, backup, and virtual machine files, as well as files on the remote locations mapped as logical drives in the victim's machine.

Although the ransomware does not exhibit wiper behavior or delete volume shadow copies, it corrupts Windows Explorer, disables the Run command window, and removes all applications and folders from Windows startup.

It's known to corrupt the deleted files in the Recycle Bin folder and alter the file names and types and make Windows Registry modifications to achieve persistence.

The threat actors behind the campaign and their operational model are unknown as yet.

"Based on the Xorist ransomware, MortalKombat spreads through phishing emails and targets exposed RDP instances," Bitdefender said.

"The malware gets planted through the BAT Loader that also delivers the Laplas Clipper malware."

MortalKombat is not the only Xorist variant to have emerged in the threat landscape over the past few months.

In November 2022, Fortinet FortiGuard Labs revealed another version that leaves a ransom note in Spanish.

The development also comes a little over a month after Avast published a free decryptor for BianLian ransomware to help victims of the malware recover locked files without having to pay the threat actors. 

Signs of infection

MortalKombat Ransomware encrypts data and generates files with a specific extension:


It also changes the desktop wallpaper to give it a Mortal Kombat theme and generates a ransom note called HOW TO DECRYPT FILES.txt.

Free decryptor to the rescue

Bitdefender has released a free universal decryptor for the current version of MortalKombat, available below:

Download MortalKombat decryptor 

The tool can also be executed silently via a command line.
If you need to automate deployment of the tool inside a large network, you might want to use this feature.

-help - will provide information on how to run the tool silently (this information will be written in the log file, not on console)

start - this argument allows the tool to run silently (no GUI)

-scan-path - this argument specifies the path containing encrypted files
• -full-scan - will enable the Scan entire system option (ignoring -scan-path argument)

-disable-backup - will disable the file Backup option

-replace-existing - will enable the Replace previously decrypted files option


BDMortalKombatDecryptTool.exe start -scan-path:C:\ 

-> the tool will start with no GUI and scan C:\

BDMortalKombatDecryptTool.exe start -full-scan

 -> the tool will start with no GUI and scan entire system

BDMortalKombatDecryptTool.exe start -full-scan -replace-existing

 -> the tool will scan the entire system and overwrite present clean files.