Viruses

Bazek is a virus infection that features all the traits inherent to ransomware. Put simply, it encrypts access to data (using AES-256 algorithms) and asks victims to contact cybercriminals in order to get a special decryption key. During encryption, the virus also assigns the new .bazek extension to each targeted file. To illustrate, a file named 1.pdf will change to 1.pdf.bazek and lose its original icon as well. Depending on what version of Bazek Ransomware attacked the computer, it will either create a text note called README.txt or display a pop-up window with similar decryption instructions.

Also known as Sullivan, RansomBoggs is a ransomware infection designed to encrypt data and demand payment for decryption afterwards. Recent research showed that this virus has had numerous attacks on various organizations placed in Ukraine. During encryption, RansomBoggs renames all targeted files with the .chsch extension. For example, a file originally titled as 1.pdf will change to 1.pdf.chsch and become no longer accessible. Following this, the ransomware also creates its own note (SullivanDecryptsYourFiles.txt) with decryption instructions.

SEX3 is a computer virus classified as ransomware. Also, it was discovered to be a new version of another file encryptor called SATANA Ransomware. Software of this type is developed to encrypt potentially valuable data and demand file owners to pay money for their decryption. While running encryption, SEX3 Ransomware is programmed to alter targeted files with the .SEX3 extension. This is simply a visual change to highlight blocked data on top of successful encryption. After this, the virus changes the desktop wallpapers and also creates a text note called !satana!.txt that contains short instructions about how to unlock access to files.

Onelock is a ransomware infection developed by the Medusa ransomware family. Its purpose is to encrypt access to potentially important data (using RSA and AES encryption algorithms) and extort money from victims for full decryption. While rendering files inaccessible, the virus adds the new .onelock extension, which would make a file like 1.pdf change to 1.pdf.onelock and reset its original icon. The same pattern applies to other files that get targeted by the infection. After successful completion, Onelock creates the how_to_back_files.html file to feature decryption instructions. Overall, it is said that ransomware developers are the only figures able to decrypt victims' data. For this, victims are therefore instructed to contact cybercriminals using a chat link in Tor Browser (or e-mail) and pay some specified amount of ransom.

Alpha865qqz is a new file encryptor that belongs to the Maoloa ransomware family. While running an investigation concerning this malware, it was spotted that Alpha865qqz mimics some traits of another infection called GlobeImposter. For instance, during encryption, it appends the .Globeimposter-Alpha865qqz extension to targeted files. To illustrate, 1.pdf will change to 1.pdf.Globeimposter-Alpha865qqz, 1.png to 1.png.Globeimposter-Alpha865qqz, and so forth. After completing the encryption process, Alpha865qqz creates an executable file called HOW TO BACK YOUR FILES.exe that lists decryption instructions. Some other versions of Alpha865qqz created the HOW TO BACK YOUR FILES.txt text file instead, and also changed the original icons of files.

Faust is a new ransomware variant developed by the Phobos malware group. Its purpose is to encrypt potentially important pieces of data and make victims pay money for its decryption. Along with encryption, the virus also alters the way files appear - for instance, a file originally named 1.pdf will change to something like 1.pdf.id[9ECFA84E-3421].[gardex_recofast@zohomail.eu].faust and reset its original icon after encryption. This new string of characters that ransomware appends consists of a unique victim's ID, cybercriminals' email address, and the .faust extension. Following the successful completion of the encryption, Faust Ransomware generates a pop-up window (info.hta) and text file (info.txt) that contain decryption guidelines.

Cypher is a remote administration trojan (RAT) promoted by cybercriminals to control Android devices and run a number of malicious actions on them. Once it hacks an Android device, threat actors become able to manage almost the whole device for achieving their purposes. Cypher is also a public trojan that can be purchased by anyone in form of subscription plans on the developers' website. One of the special features that cybercriminals behind Cypher get access to is the so-called clipboard hijacker. It is designed to substitute copied addresses of crypto wallets with ones owned by trojan owners. In other words, if a victim runs some cryptocurrency transaction while the trojan is on the smartphone, cybercriminals will be able to stealthily replace the copied address and receive the payment to their wallet instead. Apart from this, Cypher RAT has a plethora of other capabilities typical for such malware. For instance, it can change smartphone wallpapers, manage calls and SMSs, force-open various apps, manipulate the screen, memorize keyboard strokes, take screenshots, use a microphone to record incoming audio, analyze the device location, download additional software, read 2-factor authentication codes, imitate log-in windows, and other such functions aimed at benefiting cybercriminals in any desired way.

AXLocker is a ransomware virus that encrypts personal data (documents, photos, databases, etc,) and demands victims to pay money for its decryption. Unlike other ransomware infections that typically rename encrypted data (by adding new extensions), AXLocker leaves files to look in their original appearance. Despite this, victims will not be able to access their data and the virus will then display a pop-up window with decryption-related demands and allocated time to meet them.