How to remove Kupidon ransomware

Kupidon ransomware is the cryptovirus that targets companies and mainly spreads in Romania

Kupidon ransomware – malware that encrypts data and demand payment from the victim by claiming to have a decryption tool needed for the proper file restoring. The initial report^[1] about this new threat states that it is a possible copy of some other older ransomware because the ransom note text delivered via !KUPIDON_DECRYPT.TXT file resembles a threat from before, but that is not new since many actors reuse information or code from other threats to build their own malware. Also, the post from researchers reveals that targets of this cryptovirus are mainly companies, and most of them are related to Romania. There are not many samples, at the time, but more details reveal that threat is dangerous and can evolve petty quickly. 

Kupidon ransomware virus is not reported to come from another family or malware developers. Once the machine is infected, that runs the encryption on common files using AES and RSA algorithms.^[2] File locking is ensuring that creators have a reason for the money demands and scary messages that come right after the encryption. When images, documents, archives, or different types of files get encoded they become useless and receives .kupidon marker at the end, so the victim can differentiate which files got encrypted. Even though ransomware directly corrupts common files on the machine, system data can get affected when the malicious processes running in the background or parts of the system like registry entries and security tools altered.

Kupidon ransomware starts with the encryption process, during which files get appended with .kupidono extensions and ransom note indicating the same name of the ransomware get placed in various folders. This !KUPIDON_DECRYPT.TXT file is created to inform people about further actions and encourage them to pay the demanded amount for the criminals.

Unfortunately, the Kupidon ransomware virus is focused on getting money and making a profit. Your files, devices, and other belongings are not important for the cybercriminals, so trusting them is not a good option. Malicious actors may even offer the test decryption for you to fake that this is a legitimate service and that decryption tool works.

The test decryption prior to the payment can be performed on files no larger than 10 MB. This may be the case because criminals store some of these files for the purpose of tricking you that data got recovered. Do not fall for any of these tricks that attackers use.

The text displayed in Kupidon ransomware ransom note:

 All your files have been encrypted with Kupidon Virus.
Your unique id: 
As a private person you can buy decryption for 300 $ in Bitcoins.
But before you pay, you can make sure that we can really decrypt any of your files.
The encryption key and ID are unique to your computer, so you are guaranteed to be able to return your files.
To do this:
1) Download and install Tor Browser (https://www.torproject.org/download/)
2) Open the http://oc3g3q5tznpubyasjgliqyykhxdfaqge4vciegjaapjchwtgz4apt6qd.onion/ web page in the Tor Browser and follow the instructions. 

Kupidon ransomware mainly targets companies and businesses, so the ransom amount can go up a notch and be specific for the particular target. However, even large businesses shouldn't pay this demand and remove malware instead. The ransom payment page shows the following:

1) Send a few encrypted files (no more 3 files, no more 10 MB per letter) to kupidon@cock.li . Dont forget to include you ID from ! KUPIDON_DECRYPT.TXT .
2) We will decipher them and send you back with bitcoin address for payment.
3) After payment ransom for Bitcoin, we will send you a decryption program and aes-key with instructions. If we can decrypt any of your files, we have no reason to deceive you after payment. 

You need to remove Kupidon ransomware instead of paying the ransom because the options of getting your files may be false and not possible at all. Decryption tool officially is not released yet, so the option for file recovery is only one- data backups. Of course, you can rely on some third-party programs and our suggestions below, but the best thing you can do when encountered such intruder is run the cleaning process.

Kupidon ransomware removal results are the best when you rely on professional anti-malware tools and can clean the threat completely alongside other possible infections or malicious files, applications. Security tools cannot recover those encrypted documents or images, but you shouldn't even consider file recovery until the system is virus-free. 

Kupidon ransomware can easily run the encryption algorithms again and affect files you newly added on the machine. This way you lose all of your data. This can happen to your external data backup when you plug in the USB device to the still infected computer. We strongly advise staying away from criminals and terminating the threat ASAP. 

The process of cleaning the machine can get difficult when Kupidon ransomware damages shadow volume copies, alters Windows registry entries, changes settings, or disable programs that can be helpful for either malware termination or file recovery. We have listed a few tips to bypass these changes below.

As for the virus damage that Kupidon ransomware causes, rely on optimization software or tools designed to repair computers like FortectIntego and run the full check for affected files. Later on, you can repair any corrupted parts of the system. Experts^[3] always note how important it is to get rid of the damage and repair functions as to the normal stage. 

Malware targets users data by dropping the payload via a malicious file

Payload droppers for the ransomware-type malware can be anything from trojans, other cyber threats, to files attached to email notifications that contain malicious macro triggering functionalities. Malware script initiates the installation of the main launched of the threat, so the infection happens and the system gets affected significantly.

These files that spread malware can be disguised as PDFs, Microsoft Word, or Excel documents and state about important information, so people fall for the trick and download the attachment from a questionable email. At this point, users' interaction is needed because malicious macros need to be enabled. The file that you open shows a form to agree on, so the content can be displayed.

One-click and malware script gets dropped directly on the system. If you want to avoid such infiltration, you need to delete any suspicious emails after receiving them and rely on proper security tools before downloading anything from the internet, Most of such tools can check the attachment and show if that is safe to download.

Kupidon ransomware termination includes cleaning infectious files from the system

When you encounter the Kupidon ransomware virus, you should take the additional infections and programs that can be loaded behind your back, into consideration. Anything related to the malware that is left on the machine can affect the persistence of the ransomware and interfere with security tools, other methods of data recovery, and malware elimination.

Kupidon ransomware removal can be achieved with anti-malware tools that check the system for malware and intruders, deletes those payload files and other threats. Security programs like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes can for such purposem but you may want to reboot the machine in Safe Mode with Networking first to get better results. 

When you remove Kupidon ransomware using the anti-malware program, you can be sure that no additional threats can run in the background. However, some of the alterations that malware does to system files and functions can trigger unwanted symptoms or even further damage, so running FortectIntego or a different PC repair tool can help to fix the damage completely.