Viruses

PLAY is a ransomware-type virus that runs encryption of important data and extorts money from victims. While rendering files inaccessible, it assigns the .PLAY extension and also creates a text note called ReadMe.txt. For instance, a file previously titled 1.pdf will change to 1.pdf.PLAY and reset it's icon after encryption. Since then, victims lose control over their data and have to read instructions on its recovery in the created text note. It is common for ransomware infections to be distributed via phishing techniques. A virus may be disguised as some legitimate-looking file (e.g., Word, Excel, PDF, EXE, JavaScript, RAR, ZIP, etc.) and be sent inside of an e-mail spam letter. Such a letter may present information explaining the “importance” of opening attached files or links.

Ransomcrow is a ransomware infection designed to encrypt valuable data and blackmail victims into paying money for its retrieval. During encryption, it assigns the .encrypted extension, which is generic to many file-encryptors. To illustrate, a file initially named 1.pdf will change to 1.pdf.encrypted and also drop its icon. After this, the virus creates a text note called readme.txt and also replaces desktop wallpapers. Information within the generated note is meant to guide victims through the recovery process. It is said a payment equivalent to €50 in Bitcoins is necessary for transfer to get special decryption tools and return the data. Victims can also contact swindlers for in-person communication via the given email address (ransomcrow@proton.me). As a rule, decryption without the help of cybercriminals is very complex and even impossible - it may be the opposite if there are some bugs or flaws alleviating third-party interference.

Payt is the name of a ransomware infection that encrypts system-stored data and blackmails victims into paying money for its return. It does so by adding new filenames (consisting of unique victim's ID, cybercriminals' e-mail, and .Payt or .payt extension). For instance, this is how an image file infected by Payt Ransomware will likely appear - 1.png.[MJ-YK7364058912](wesleypeyt@tutanota.com).Payt. After this, a money-demanding note called ReadthisforDecode.txt gets generated onto the desktop. As stated within this message, victims should write an e-mail to wesleypeyt@tutanota.com or wesleypeyt@gmail.com addresses and express their interest in decrypting data. It is also possible to send a test file and get it decrypted for free - this way cybercriminals seek to illustrate that their decryption actually works and can be relied on.

World2022decoding is a recent ransomware infection that was spotted encrypting device-stored data and blackmailing victims to pay money for it. During encryption, all affected files get appended with the victim's personal ID, and the .world2022decoding extension as well. As a result, it acquires a new look similar to this - from previously uninfected 1.png to now restricted 1.png.[9222911A].world2022decoding. This is only an example and it can happen to any piece of data, especially documents and databases. Cybercriminals also create a text note called WE CAN RECOVER YOUR DATA.MHT that entails instructions on how to return the files.

Arai is a malicious program that targets corporate users to encrypt business data and demand victims pay money for its return. While restricting access to data, the virus alters files with the .araicrypt extension, leading to blank icons as well. For instance, a file like 1.pdf would change to 1.pdf.araicrypt and lose its original icon. After this, data becomes inaccessible and no longer usable. The next step Arai does is creating a text note called READ_TO_RESTORE_YOUR_FILES.txt. This note gives clarification on what happened and how victims can recover from it. In short, cybercriminals inform that all important data (databases, customer data, etc.) has been copied and local backups have been deleted. It is also said that in case of non-compliance with the provided instructions, victims will lose a chance to recover the data and also become subject to suffering both financial and reputational - due to potential data publication that may ensue afterward. Otherwise, victims should contact the swindlers using one of the given email addresses and pay for decryption (supposedly expensive and in cryptocurrency). In such a case, the extortionists promise to wipe out the collected data and not publish it, therefore.

Kriptor is the name of malicious software categorized as ransomware. Its main purpose lies in the encryption of personal files and extraction of money from victims. The virus starts by restricting access to valuable data (photos, videos, documents, databases etc.). It also changes all the affected filenames with the .Kriptor extension to highlight encryption. For instance, a file previously titled as 1.pdf will change to 1.pdf.Kriptor and reset its icon as well. After this part is done, Kriptor creates a text note (read_it.txt) designed to explain decryption instructions. The desktop wallpapers get replaced as well. It is said victims have an opportunity to contact cybercriminals using one of the following e-mail addresses - leljicok@gmail.com or kkizuko@yandex.com and pay for decryption in Bitcoins. The exact price remains in secret and is to be revealed upon successful reach-out to swindlers. Ransomware developers also offer to test free decryption prior to paying the decryption fee - users are allowed to send up to 3 encrypted files and get them fully accessible in return. This way, cybercriminals try to create an additional bubble of trust, making victims more likely to pay for decryption.

Conteban is a remote-access trojan that, upon successful Infiltration, manipulates system features to run malicious actions on it. While the actual purpose of this virus remains unclear, malware of such tends to cause chain infections. This means that Conteban may act as a "backdoor" to bring other viruses, such as ransomware, along the way. Ransomware is a devastating malicious software that usually encrypts system stored data and blackmails victims into paying money for its return. In addition, many developers behind trojan infections also seek the extraction of valuable information (e.g. passwords, log-ins, banking credentials, etc.). This data can therefore be misused to perform fraudulent financial operations, putting users' funds and privacy at significant risk. Sometimes, however, there is software mistakenly tagged as Trojan-Win32/Conteban by various antivirus engines, including native Windows Defender. These false positives happen pretty often and may occur while launching or installing a third-party file downloaded from the web. If you suspect your system to be actually infected, or you doubt the trustworthiness of the file downloaded, we recommend you use our guide to make sure nothing threatens your PC.

Also known as Exo Android Bot, Exobot is a dangerous and highly-disruptive piece of malicious software designed to infiltrate Android devices. Exobot is similar to functions carried out by many banking trojans. In essence, it settles within a system and performs a number of phishing actions aimed at extracting valuable information from users (e.g. bank card credentials; passwords, log-ins, and even identity information). It does so by accessing Accessibility Services and manipulating an infected device through WiFi or Mobile networks. Alternatively, if there is no internet connection available, Exobot, is also capable of performing device control through SMS messages, which expands its abuse potential. In order to trick users into entering their credentials, cybercriminals may create simulated layers of popular apps (Google Play; WhatsApp, Viber, etc.) that pop on the screen and hardly differ from authentic ones. Smartphone trojans are usually granted extensive permissions giving full freedom to threat actors on what they can do. This includes forced device locking, blocked access to certain applications, screen capture, SMS management, microphone, and camera manipulation along with other compromising features as well. Exobot is especially known for the botnet feature allowing developers to link a number of infected devices and control them together from the same server to execute malicious steps. In conclusion, malware like Exobot is very devastating as it may lead you to deal with serious privacy issues, financial risks, downgraded device performance, or even identity theft. Thus, we recommend you follow our guidelines below and get rid of this virus as soon as you are able to.