Viruses

Babyduck is a ransomware infection that encrypts data by assigning the .babyduck extension. The word encryption means users will no longer be able to open system-stored files because they are blocked. Those files will undergo two visual changes - a new extension and a reset of shortcut icons. To illustrate, a file like 1.pdf will be altered to 1.pdf.babyduck and drop its icon to blank. Right after this, Babyduck creates a text note with ransom instructions (README.babyduck). Research related to this ransomware version has been temporarily frozen and not yet updated. The only thing that stands out clearly is how encrypted data will look after the ransomware attack. Despite there is no precise information on ransom instructions, they are more likely similar to other file-encryptors. Cybercriminals will probably ask you to pay for special decryption software that will access your data. The payment can be usually done only in cryptocurrency like Bitcoin. Apart from this, it is also common to see extortionists offer free file encryption.

Nqsq Ransomware is complex encryption-type virus, that uses AES (Salsa20) algorithm to cipher user files. Data affected by this malware become unavailable without a special decryption key. The virus gets slightly modified every week and recent versions append the following extensions: .nqsq. Nqsq Ransomware does not touch system files but may block navigation to certain security websites using the Windows "hosts" file. When users try to download anti-malware or decryption tools, the pest won't allow them to do it. You can easily download recommended programs from our site and read instructions on how to use them. Ransomware copies file _readme.txt, the so-called "ransom note", on the desktop and to the folders with encrypted files. The text file contains information about the infection, ways to pay the ransom, and contact information.

SUPERSUSO is a ransomware program that uses strong encryption algorithms to cut users from accessing their own data. Such a change is meant to stimulate people into paying the so-called ransom to recover encrypted files. Victims will learn about file encryption by new extensions assigned to them. SUPERSUSO developers use the .ICQ_SUPERSUSO extension to rename all the blocked data. For instance, a file like 1.pdf will change to 1.pdf.ICQ_SUPERSUSO and reset its original icon. The same will be applied to all data blocked across your system. After this, SUPERSUSO issues a text file named #Decrypt#.txt to explain recovery instructions. At first, victims are instructed to install ICQ software for PC, Android, or IOS and write to cybercriminals' recipient address, which is mentioned in the note. ICQ is a reliable and legitimate messenger used by cybercriminals to establish anonymous communication with their victims. Should victims fail to contact developers within 72 hours, the compromised information will be gathered and leaked to darknet markets.

Shasha is the name of a ransomware virus that encrypts and changes data with the .shasha extension. The new extension is not an essential part of the encryption, but rather a visual aspect meant to highlight the blocked data. If you see this extension assigned to most of the data like this 1.pdf.shasha, then you are undoubtedly infected with ransomware. The developer's next step after blocking access to files is to explain how to recover it back. For this, cybercriminals in charge of the Shasha virus create a text note called READ_ME.txt and change desktop wallpapers. Inside of this note, extortionists claim they are the only figures able to decrypt your files. To be more precise, they are the ones holding private keys and decryption software that can unlock the data. Victims are requested to buy it for 50$ in BTC. The payment has to be sent through the Bitcoin address attached in the note. Unfortunately, it is quite uncertain how cybercriminals are going to send the purchased decryption software to you.

Mded Ransomware (also know as STOP Ransomware) is a cynical virus that knocks out the soil and leaves users at a loss because it affects the most intimate type of information - personal photos, videos, e-mails, as well as documents, archives, and other valuable data. Ransomware is a type of threat that not only encrypts those files but demands a buyout. STOP Ransomware is officially the most widespread and dangerous virus among the file-encrypting type of malware. There have been more than 260 versions of it and latest struck with .mded extensions. Such suffixes are added by Mded Ransomware to files it encodes with its powerful AES-256 encryption algorithm. In 99% of cases, its algorithms are unbreakable, however, with instructions and utilities covered in this article you get this 1% chance of recovery. First of all look at the ransom note, that Mded Ransomware copies to the desktop and affected folders. The file _readme.txt serves as a marker to distinguish one version from another.

CommonRansom is classified as a ransomware virus that encrypts data stored on infected devices to demand payment for its return. This version was discovered by a malware researcher named Michael Gillepsie. Just like many ransomware infections, CommonRansom assigns its own extension to highlight the blocked data. All data that got encrypted by CommonRansom will change like this file here - 1.pdf > 1.pdf.[old@nuke.africa].CommonRansom. After this, one more thing left to initiate by the virus is ransom note creation. The name of the note is DECRYPTING.txt and it is put to each folder with infected files. This note says victims have 12 hours ahead to request data decryption, otherwise, there will be no chance to return it anymore. There is also a template that should be used when contacting cybercriminals by their e-mail address. The attached template is actually very suspicious since it requests victims to write their PC RDP port, a username along with password used to log into the system, and the time when you paid 0.1 BTC to the outlined crypto address.