Each file on the victim’s computer becomes the target of the Eucy virus. This means the following, if the file was named ‘document.docx’, then after it is encrypted, it will be called ‘’. This gives hope that the ransomware victims will be able to decrypt files without paying ransom.Įucy virus renames each encrypted file by adding the extension. The offline key is fixed and can be determined by security researchers. The main difference between an online key and an offline key is that the online key is in the hands of criminals and cannot be determined. If the connection to the command server has not been established, then the virus uses a fixed key (so-called ‘offline key’). If this succeeds, the virus sends data about the infected computer to the server, and from it receives a key (so-called ‘online key’) necessary for file encryption. After that, Eucy virus tries to connect to its command server. Upon execution, the virus creates a directory in the Windows system directory, copies itself to this directory, changes some OS settings, and also collects information about the infected computer. Typically, ransomware such as Eucy can infect a computer when installing programs downloaded from torrent web-sites as well as when running cracked games, freeware, key generators and other similar software. Eucy virus sneaks into the system without any visible symptoms, which is why users notice that their computer is infected too late, when the files are already encrypted.

Screenshot of files encrypted by Eucy virus (‘.eucy’ file extension) QUICK LINKSĮucy ransomware is a new malware that is created to encrypt files located on the victim’s computer, and then extort money to decrypt them.

File decryption tool free