Ransomware Archives | Page 3 of 19

Dharma-Good Ransomware is typical representative of encryption viruses from Crysis-Dharma-Cezar ransomware family. This sample appends .good extension to affected files. Dharma-Good Ransomware adds complex extension, that consists of unique id, developer’s e-mail and .good suffix. As a result, file named 1.doc will be converted to 1.doc.id-{8-digit-id}.[{email-address}].good. Dharma-Good Ransomware developers can extort from $500 to $15000 ransom in BTC (BitCoins) for decryption. Usually, it is quite big amount of money, because hackers pay the commission to Dharma Ransomware as Service (RaaS) owners. Using cryptocurrency makes it impossible to track the payee. Besides, victims of such viruses often get scammed, and malefactors don’t send any keys even after paying the ransom. We do not recommend to pay any money to malefactors. Usually, after some period of time security specialists from antivirus companies or individual researchers break the algorithms and release decryption keys. Mention, that some files can be restored by using backups, shadow copies, previous versions of files or file-recovery software.

May 16, 2019 James Kramer 0

How to remove STOP (DJVU) Ransomware and decrypt .bufas, .ferosas, .dotmap or .radman files

Standard

STOP Ransomware (DJVU Ransomware) continues its malicious activity in May, 2019, and now adding .bufas, .ferosas, .dotmap or .radman extensions to encrypted files. Malware aims most important and valuable files: photos, documents, databases, videos, archives and encrypts them using AES-256 algorythms. Encrypted files become unusable and cybercriminals start extorting ransom. Ransomware creates _readme.txt file, that is called “ransom note”, on the desktop and in the folders with encrypted files. Hackers demand $980 for decryption of your files (message states, that victims will get 50% discount if they’ll contact cyber criminals within 72 hours after the encryption). According to many reports, malefactors often don’t reply to victims, when they receive ransom payment. We strongly do not recommend paying any money. Files encrypted by some versions of STOP (DJVU) Ransomware can be decrypted with help of STOPDecrypter. Dr.Web specialists decrypted files encrypted with some variants of STOP Ransomware in private. Dr.Web does not have a public decoder. Before trying to decode the files, you need to stop active process, and remove STOP Ransomware.

May 16, 2019 James Kramer 0

How to remove Dharma Ransomware and decrypt .adobe, .com, .bat or .btc files

Standard

Dharma virus, unlike similar types of ransomware, does not change desktop background, but creates README.txt or Document.txt.[amagnus@india.com].zzzzz files and places them in each folder with compromised files. Text files contain message stating that users have to pay the ransom using Bitcoins and amount is approximately $300-$500 depending on ransomware version. The private decryption key is stored on a remote server, and there currently impossible to break the encryption of the latest version.

May 10, 2019 James Kramer 0

How to remove STOP (DJVU) Ransomware and decrypt .berost, .fordan, .codnat or .codnat1 files

Standard

STOP Ransomware (DJVU Ransomware is one of subtypes) is high-risk file-encrypting virus, that affects Windows systems. In May, 2019, new generation of this malware started encoding files using .berost,.fordan, .codnat or .codnat1 extensions. Virus targets important and valuable file types such as photos, documents, videos, archives, encrypted files become unusable. Ransomware puts _readme.txt file, that is called “ransom note” or “ransom-demanding note” on the desktop and in the folders with encrypted files. Hackers demand $980 for decryption of your files (message states, that victims will get 50% discount if they’ll contact cyber criminals within 72 hours after the encryption). According to many reports, malefactors often don’t reply to victims, when they receive ransom payment. We strongly do not recommend paying any money. Files encrypted by some versions of STOP (DJVU) Ransomware can be decrypted with help of STOPDecrypter.

May 7, 2019 James Kramer 0

How to remove Dharma-MERS Ransomware and decrypt .MERS files

Standard

Dharma-MERS Ransomware is another iteration of extremely dangerous Crysis-Dharma-Cezar ransomware family, that, in this case, adds .MERS extension to the end of the files it encrypts. Virus, actually, composes suffix using several parts: e-mail address, unique 8-digit identification number (randomly generated) and .MERS extension. So, finally, encoded files will receive following complex suffix – .id-{8-digit-id}.[{email-address}].MERS. As a rule, Dharma-type Ransomware extorts for $500 to $1500 ransom, that can be paid in Monero, Dash or BTC (BitCoins), and in return they promise to send decryption key. Using cryptocurrency makes it impossible to track the payee. We do not recommend to pay any money to malefactors. Usually, after some period of time security specialists from antivirus companies or individual researchers break the algorithms and release decryption keys. Mention, that some files can be restored by using backups, shadow copies, previous versions of files or file-recovery software.