Ransomware

STOP Ransomware (in other classification DJVU Ransomware) is harmful malware, that blocks access to user's files by encrypting them and requires a buyout. The virus uses unbreakable encryption algorithm (AES-256 with RSA-1024 key) and demands ransom to be paid in BitCoins. However, due to some programming mistakes, there are cases when your files can be decrypted. Version of STOP Ransomware, that we are considering today adds .besub, .godes, .cezor or .lokas extensions to encrypted files. After the encryption it presents file _readme.txt to the victim. This text file contains information about the infection, contact details and false statements about decryption guarantees. The infection with STOP Ransomware is very unfortunate, but you should keep calm. Do not succumb to provocations, and do not trust the hackers. In most cases, they will never return your files after paying the ransom. Think of possible backups and duplicates of the affected data, that may be stored elsewhere. There is a great called STOPDecrypter, developed by Michael Gillespie, that, probably, will help you to decrypt sensitive information.

CryptON Ransomware or Nemesis Ransomware or X3M Ransomware is one of the most dangerous and wide-spread ransomware families. Currently, there are multiple successors of initial virus and several deviations built on another platforms. Cry9, Cry36 and Cry128 Ransomware came from this series. Virus uses mix of AES-256, RSA-2048 and SHA-256 encryption algorithms Latest discovered version is actually called CryptON Ransomware and uses .ransomed@india.com extension for affected files. Ransom demand from 0.2 to 1 BitCoin for decryption. It is not recommended to pay the ransom as there are no guarantee malefactors will send decryption key. Use instructions on this page to remove CryptON Ransomware and decrypt .ransomed@india.com, _x3m or _locked files from Windows 10, Windows 8 or Windows 7.

Rapid V3 Ransomware (a.k.a Rapid 3.0 Ransomware) is new iteration of notorious Rapid Ransomware. This version uses AES encryption algorithm and can append following extensions to user files: .guesswho, .mouse, .GILLETTE, .no_more_ransom, .nano, .ezymn, .rpd, .[5-random-characters]. Currently, there is no decryptor with confirmed working capacity for Rapid V3 Ransomware. However, using backups, recovery software or other pieces of advice from this page can help you recover encoded files. The virus uses the same template for a ransom note. Some variation create ransom note with name: How Recovery Files.txt. Rapid V3 Ransomware extorts 0,7 BitCoins (BTC) for recovering files from decryption. Users can contact developers using e-mail demonslay335@rape.lol, which is a reference to and mockery of a famous security researcher from Bleeping Computer forum, who has nickname "demonslay335". There is information about the victims from the following countries: USA, Iran, Germany, Japan, Benin, South Korea, Indonesia, Spain, Malaysia, India.

Aurora Ransomware (sometimes called OneKeyLocker Ransomware) is new crypto-virus, that started circulating the web since the end of May, 2018. The virus mostly aims Western countries, however, some versions were spread in Turkey. It uses DES algorithm to encode files and adds .aurora extension, after which it got its name. Since that, malware had multiple updates and modifications. Ransomware now also adds following extenions: .nano, .cryptoid, .peekaboo and .isolated. After encryption ransomware creates different text files (depending on version), containing ransom note with contact information and instructions.

Dharma virus, unlike similar types of ransomware, does not change desktop background, but creates README.txt or Document.txt.[amagnus@india.com].zzzzz files and places them in each folder with compromised files. Text files contain message stating that users have to pay the ransom using Bitcoins and amount is approximately $300-$500 depending on ransomware version. The private decryption key is stored on a remote server, and there currently impossible to break the encryption of the latest version.