Viruses

Dharma is a ransomware family considered to be the biggest developer of ransomware infections. Lots of versions have been found attacking users with data encryption and ransom-demand messages. However, one of the recent versions spotted being active around is known as yoAD Ransomware. Alike similar viruses of this type, it assigns the new .yoAD extension with random ID and cybercriminals' e-mail to each piece of data stored on a compromised PC. For example, the original file like 1.mp4 will get a look of 1.mp4.id-C279F237.[yourfiles1@cock.li].yoAD, or similarly. Such changes make your files are no longer accessible as any attempts to initiate them will be denied. Then, once this process gets to a close, the virus steps in with the creation of text instructions. They are presented in the FILES ENCRYPTED.txt document right on your desktop. As extortionists claim, the only way to restore your data is by contacting them via e-mail. Then, they will supposedly give you a crypto-wallet to send money in Bitcoin. After this, you will be given the necessary tools to restore your data. Unfortunately, this method does not fit everybody because amounts asked by cybercriminals can be astronomically high and not easy to pay.

Crypto-Locker Mijnal is a ransomware-type infection that encodes personal data with AES+RSA algorithms. The application of such means that the assigned cipher is hard to break using traditional methods. In other words, it makes sure manual decryption does not take place after data is locked. Unfortunately, in most cases, it appears to be impossible indeed, but you should give it a try after reading this text. Alike other infections, Mijnal encrypts your data by changing a file extension to .mijnal. For example, a sample like "1.mp4" will be altered to "1.mp4.mijnal" and reset its original icon. After the encryption process gets to a close, the virus creates a text note called "README_LOCK.txt" that contains redemption instructions. The information presented inside is written in Russian, which means that developers mainly focus on the CIS regions. However, there are some English users that may be affected by it as well. If you are willing to decrypt your data as soon as possible, cybercriminals ask victims to open the attached link via the Tor browser and follow the instructions right there. Then, extortionists will more likely ask you to pay a certain amount in Bitcoin to gain access back to your data. Despite paying the ransom is usually the only method to overcome data encryption, we recommend against meeting any requests as it can be dangerous for your pocket and privacy as well.

DPD Delivery Email is a scam-based message delivered to users via e-mail. Whilst trying to shadow itself behind DPD (a legitimate delivery service), cybercriminals aim to spread a trojan known as DanaBot. To make users pull the infection process, they say your parcel is on the way and soon to be delivered. To track the status and location of a package, you should click "Run Parcel Track", which will drop you over the download page. On this page, there will be an archive containing a malicious JavaScript file (with .js extension). If downloaded, the trojan will spread into your system and gather banking details like passwords entered during the browsing session. Then, the collected information can be sold or used on their own to hack the recorded accounts. Also, the spam message offers to install a DPDgroup application. To do this, you are guided to click on "Find our more", which leads to the same page with the infection. In addition to that, you should know that fake e-mail campaigns can be the source of ransomware infections as well. They do exactly the same trick pushing users into downloading malicious files (MS Office documents, PDFs, or executables).

Leitkcad is a pure example of crypto-malware that runs encryption over personal data to garner a so-called ransom. The most vivid symptoms hinting at the Leitkcad's presence is the assignment of .leitkcad extension. In other words, it will be seen at the end of each file affected by malware. For example, a file like 1.mp4 will be changed to 1.mp4.leitkcad and reset its original icon. Then, once all of the files are changed, the virus moves to the next phase creating a note called help-leitkcad.txt. It contains information on the encryption as well as instructions to restore your data. Cybercriminals say that you should contact an operator and fill in your ID, personal key, and e-mail via the chat page. The link to it can be opened only by using the Tor browser, which has to be downloaded by victims. Then, after establishing contact with cybercriminals, you will receive further instructions on how to purchase the decryption software. Also, it is worth-noting that rebooting and altering encrypted files can lead to permanent loss. Extortionists set certain algorithms that help them detect your activity. This means that if you refuse to comply with any of the above warnings, your files will be deleted momentarily.

A new cryptovirus known as LuciferCrypt stepped into the game a couple of days ago to encrypt personal data. As long as the study goes, it is already evident that this ransomware restricts access to data by assigning a long-string extension (.id=[].email=[].LuciferCrypt). A quick illustration of an infected sample would look like this 1.id=0ED53ADA.email=cracker.irnencrypt@aol.com.LuciferCrypt.mp4. After the encryption process is done, the virus continues its presence creating a text file called HowToRecoverFiles.txt. Within this document, extortionists are notifying victims about successful encryption. To revert it, victims should contact cyber criminals via e-mail and pay a fee to recover the files. Once done, your data will be decrypted automatically, without involving any manipulations. It is also said that the price directly depends on how fast you reply to the swindlers. Before doing that, you are also allowed to take advantage of free decryption. Developers offer to send up to 3 files (less than 4MB and non-archived), which should not contain valuable information.

After Pump Ransomware attacks your system, all data become chained by strong algorithms restricting access to it. The malware appends .pump extension to the files it encodes. For example, a file like 1.mp4 will acquire a new look of 1.mp4.pump and reset its original icon. The extension applied in the end means that your files are under encryption. Such modifications are usually accompanied by the creation of ransom instructions. In our case, the virus drops a text file called README.txt that will help you recover the files. The content presented inside is short, cybercriminals only attached their e-mail address to call victims into contacting them. Then, they will supposedly give further instructions on how to purchase the decryption software. No matter how far the price goes, complying with the requests of swindlers is risky - they may become foolish in their promises and leave you no tools even after making a payment.

MARS Ransomware is a malicious program discovered by Michael Gillespie. The way it encrypts files is very similar to other infections of such type - by appending the new .mars or .vyb extension to highlight the affected data. Victims will see their files transform into something like this 1.mp4.mars or 1.mp4.vyb. As a result of these actions, files cannot be opened or manipulated by users in any way. To fix it and recover your data, cybercriminals offer to read instructions in a text note (!!!MARS_DECRYPT.TXT) created after encryption. It informs you that various data types stored on your PC have been encrypted with the virus. To revert it, people have to pay 500$ in BTC for the decryption key. Before doing so, extortionists strongly insist on sending up to 3 files for free decryption to make sure of their trustworthiness. After this, the cybercriminals team will reply back with the payment link towards purchasing their software. You can also contact developers via Telegram and buy the key right away without testing free decryption. Although such features provided by swindlers may instill trust in their intentions, it is recommended against agreeing on what they say, because there is no actual guarantee that they will return your data safe and undamaged.

FileEngineering is an example of ransomware-infection configuring files of victims to restrict access to them. Most of the time, users do not spot malware coming into the systems. Once upon a time, they end up seeing their data changed and locked from regular access. FileEngineering does it this way - by assigning victims' ID, cybercriminal's e-mail address, and .encrypted extension at the of the files. There are two versions of FileEngineering being spread around the web. The only difference is in using different e-mail addresses to contact swindlers. For example, you may see your data appear as 1.mp4.id=[BE38B416] Email=[FileEngineering@mailfence.com].encrypted or id=[654995FE] Email=[FileEngineering@rape.lol].encrypted depending on which version affected your PC. Then, the next step of FileEngineering's activity is creating a note called Get your files back!.txt that contains information regarding decryption. Inside of it, the information is addressed by a so-called security engineer. He says that you should contact him via e-mail and pay some amount of Bitcoin. Then, he will return your files decrypted and give some tips on improving your safety. Before that, you are also allowed to send a small file to prove he can unlock your data. Trusting cybercriminals is always a huge risk, so it is up to you whether you want it or not. If files are not of big value to you, you can simply delete FileEngineering and continue using your PC.