Viruses

Updated version of STOP Ransomware ransomware appends .PAUSA, .CONTACTUS, .DATASTOP or .STOPDATA suffixes to encrypted files. Virus still uses RSA-1024 encryption algorithm. All versions, except .STOPDATA, demand $600 ransom in BTC (BitCoin cryptocurrency), last one offers decryption for $200. Still malefactors offer to decrypt from 1 to 3 files for free to prove, that decryption is possible. This can be used to attempt decoding in future. At the moment, unfortunately, the only way to restore your files is from backups.

Dharma-Arena Ransomware belongs to CrySis family, previous wide-spread ransomware of this type was Dharma Ransomware, that we described on this blog. Dharma-Arena Ransomware was detected by security researches first time in August 2017. Since then, it had numerous updates. Different versions of Dharma-Arena Ransomware demand different ransom amounts. It varies from 0,20 to 0,73 BitCoins, which is near $5000. Security experts do not recommend to pay developers of ransomware, as this encourages them to create new variations and does not guarantee decryption of your files. Actually, most times malefactors don't send decryption keys. Latest versions of Dharma-Arena Ransomware are not decryptable, however there is a chance to restore files affected by older versions.

Bip Ransomware is another successor of Dharma/Crysis Ransomware family. New variation adds complex suffix, that ends with .bip extension, to all affected files. Bip Ransomware encrypts almost all types of files, that can be valuable to users, such as documents, images, videos, databases, archives, project files, etc. It is currently unknown, what type of encryption algorithm Bip Ransomware uses, but probably it is AES. Bip Ransomware usually demands from $1000 to $2000 in BitCoins for the decryption key. However, often hackers don't send any keys and it is not recommended to pay the ransom. As for today, the 5-th of May 2018, decryption is not possible, however, you can attempt to decrypt your files from backups or trying file recovery software.

GandCrab V3 Ransomware is another generation of high-risk GandCrab virus, that uses AES-256 (CBC-mode) + RSA-2048 encryption algorithms. This version also appends .CRAB extensions to all encrypted files. GandCrab V3 creates similar CRAB-DECRYPT.txt file with changed ransom note. Unlike previous versions GandCrab V3 Ransomware uses carder.bit as a server and Psi-Plus Jabber for communication. It also modifies desktop background with unpleasant inscription. Ransomware restarts the computer after encryption is finished, and creates autorun key in the registry to run on Windows startup and attack newly created files. Ransom amount is ~$1000 and can be paid in Dash or BitCoin. Virus creates counter and deadline after which ransom amount can double.

Scarab Ransomware is a large family of international file-encrypting virus-extortionist. It has multiple versions and languages and attacks computers all over the world. Scarab Ransomware has typical malicious activity: it encrypts user files using AES encryption and demans ransom for decryption. Latest versions of this malware add .oblivion, .xtbl, .decrypts@airmail.cc or .amnesia extensions and modify filenames using randomly-generated alphanumeric sequence.

Velso Ransomware is maleficent crypto-virus, that uses AES encryption algorithm to encode user files. Ransomware mostly targets English-speaking countries, but may infect computers in any country. Affected files get .velso or .david extension and become inaccessible. After encryption Velso Ransomware creates text file get_my_files.txt with instructions to pay the ransom. The ID of the key and victim is generated by CryptGenRandom (), using AES-256 OpenSSL in ECB mode. Currently, there is almost impossible to decrypt files encrypted by Velso without master key.

STOP Ransomware is dangerous file-encrypting virus. It uses AES/RSA-1024 encryption algorithm. Depending on version, ransomware adds .STOP, .SUSPENDED or .WAITING extensions to encrypted files. First variant of STOP Ransomware creates !!!YourDataRestore!!!.txt files, second !!!RestoreProcess!!!.txt, third !!!INFO_RESTORE!!!.txt. In this files, malware demands $600 ransom, that has to be paid in 72 hours, in BitCoins. It also contains user personal id and e-mail addresses for contacting.

Hermes Ransomware wide-spread family of crypto-viruses. There have been 2 major updates of initial ransomware - Hermes 2.0 Ransomware and Hermes 2.1 Ransomware. All variants use AES-256 encryption algorithm combined with RSA-2048. First version did not add any extensions and modified only content of the files by adding HERMES file-marker. Last version started to append .hrm suffix, but then just encrypted files without filename modification. After encryption, ransomware creates text files DECRYPT_INFO.txt and DECRYPT_INFORMATION.html, that contains message with instructions to pay the ransom and contact details. You can see the contents of this files below in the next paragraph.