Deniz_Kizi ransomware: what it is and how to remove it

From our report of Jan 2020 · not reviewed since

More from our earlier report on Deniz_Kizi ransomware

• Additionally, if system crashes, error, BSODs or other problems persist, fix your Windows computer with

From our report of Jan 2020 · not reviewed since

Deniz_Kizi ransomware is malicious software that uses a double encryption algorithm to lock all personal files on host machine

Deniz_Kizi ransomware is a file locking virus that first emerged in the wild in late December 2019.

The name of malware stems from the Turkish language (Deniz Kızı translates to "Mermaid") - its developer is also Turkish, and is responsible for other ransomware strain releases, including KesLan, MaMo, and others. Nevertheless, the ransom note Please Read Me!!!.hta is written in English, so the malware targets users from around the world.

Upon infiltration, the Deniz_Kizi virus performs a variety of system changes to execute a data encryption process, which concludes with all personal files being appended with .Deniz Kızı file extension.

For that, the malware uses a relatively unique encryption scheme: it uses a rare double algorithm TR1224 to encrypt files, as well as AES-256 to encrypt the key that is required to recover the access to pictures, videos, documents, and other locked files.

Malicious actors offer to contact them via yardimail1@aol.com or yardimail2@aol.com, or yardimail1@aol.com emails and ask $400 work of Bitcoins for decryption software that would restore access to the locked data. Later variants of Deniz_Kizi ransomware dropped a ransom note Lütfen Beni Oku!!!.log which is written in Turkish. As of now, no decryption software for this malware is available, although paying criminals is not advised.

While Deniz_Kizi ransomware is relatively new, there are two main methods that the attackers use to spread the infection (nevertheless, keep in mind that cybercriminals might employ other methods for propagation):

The malicious installer Starter.exe bypasses the User Account Control feature that would warn users otherwise and immediately begins the infection process: several files dropped into %AppData% folder (svchost.exe), Task Manager and Windows startup disabled, Shadow Volume Copies deleted, startup repair disabled, Windows hosts file modified, services opened, etc. (note that you should delete the hosts file located in C:\Windows\System32\drivers\etc\ after Deniz_Kizi ransomware removal).

Once the preparations are complete, the Deniz_Kizi ransomware virus begins the encryption process, which renders files of 195 different file extensions inaccessible. Nevertheless, just like in the case of other file locking malware, system, executable, and a few other file types are skipped.

For data encryption, ransomware uses a relatively rare encryption method - a combination of TR1224 and AES-256. This ensures secure encryption, reduced chances, or users recovering data without paying for Deniz_Kizi ransomware decryptor.

Newest variants of the Deniz_Kizi virus also change the desktop wallpaper of the host machine, which shows a brief message written in Turkish, which claims that users should check the ransom note Lütfen Beni Oku!!!.log to find out more about what happened to their files.

The English version of Deniz_Kizi ransom note states the following:

As evident, threat actors behind Deniz_Kizi ransomware offer free test decryption to prove that the recovery software provided by them actually works - this trick is often used by ransomware developers in order to establish a false sense of security. However, you can never trust hackers, as they might take away your money and never send you the Deniz_Kizi decryption software.

Malicious actors warn that if the payment of $300 or $400 in Bitcoin is not transferred within two days, recovering data will be impossible.

As it is typical, it is in their best interests to claim that none of the recovery tools would work but theirs - it increases the chances of receiving a payment from victims. However, Deniz_Kizi developers do have a point, as in some cases, any type of encrypted file modification might permanently damage them.

As a remedy, you should make a copy of locked files, and then remove Deniz_Kizi ransomware from your computer by scanning it with powerful anti-malware.

• Spam email attachments that are disguised as useful documents - these ask uses to enable macro function to download the malicious payload
• Software cracks and pirated software installers - these malicious files are usually downloaded from unsafe torrent or similar sites

From our report of Jan 2020 · not reviewed since

Be careful when checking email and do not use software cracks

According to experts' findings, the most common distribution techniques used by malicious actors include spam email attachments and executables that are used for cracking software, otherwise known as cracks/keygens/loaders.

Here are the tactics that hackers use:

To avoid ransomware infection consequences, make sure you equip your computer with reliable ant-virus software, backup your personal files, update the OS and the installed programs regularly, utilize ad-blocker, enable the firewall, protect all accounts with secure passwords and never download pirated software installers/cracks.

• Malicious spam emails are one of the main attack vectors when it comes to malware distribution. While relatively primitive, it is still widely used to deliver payloads of ransomware, trojans, worms, data-stealers, rootkits, and other malware. In most cases, hackers employ botnets to send phishing messages to email addresses that were leaked previously - these can be easily obtained from the Dark Web. The pushing email includes some type of bait that prompts users to open the attachment or click on hyperlink - the former usually asks for a macro function to be enabled, while the latter might initiate the automatic installation of malware.
• Software cracks and pirated software installers also prove to be extremely successful (the most successful ransomware - Djvu - uses software cracks for propagation), , and infect millions of users who rely on such illegal installers. Placing a malicious executable disguised as a cracked program is relatively easy for cybercriminals, as there are thousands of websites that allow everyone to upload files like that to be downloaded by anyone. Typically, hackers rely on fake versions of Windows/MS Office cracking tools, video game cheats, and their installers, etc.

From our report of Jan 2020 · not reviewed since

Remove Deniz_Kizi ransomware from your machine

As previously stated, you should not remove Deniz_Kizi ransomware just yet, as you might permanently damage the encrypted files.

Even if you do not have backups available, there is a chance that security experts will find a bug within the malware or gain access to its Command & Control server due to its seizure, which would allow them to create a working Deniz_Kizi decryptor. Note that No More Ransom Project is a great database of decryption software available for everyone for free - check it regularly in the future.

Therefore, copy all the important files that are encrypted, access Safe Mode with Networking and perform a full system scan with anti-malware software such as or (new variants might be detected by all AVs, so make sure you update your security software to the latest version before performing a scan). After that, you should go to the following location and delete Windows hosts file:

Finally, you can proceed with the data recovery process. Unfortunately, there are few options without paying cybercriminals, as data recovery software does not always work - it does not decrypt the data, but rather recovers working copies of files from a local HDD.

Thus, the more the PC is used after the infection, the less of a chance you have of recovery software to work. For more details, check the information below.

[GI=method-1]Follow these steps in order to reach Safe Mode with Networking to remove Deniz_Kizi virus:

Windows Previous Versions Feature might be an answer to your problem

This option is only available to those who used a System Restore function before ransomware struck:

In some cases, ShadowExplorer might save all your data

This tool should be able to recover all your data as long as Deniz Kızı file virus failed to remove Shadow Volume Copies.

No decryption tool is currently available