It is highly probable that paying will not deliver any positive results.Ĭurrently there are no tools capable of restoring files encrypted by this ransomware. Paying is equivalent to sending your money to cyber criminals. Therefore, you should ignore all requests to pay or contact these people. In any case, cyber criminals often ignore victims, despite payments made. Cyber criminals choose the Bitcoins currency since it allows them to remain anonymous and significantly diminishes the chance of being apprehended by authorities. 5 and 1.5 Bitcoin (1 Bitcoin id currently equivalent to ~$606). The ransom amount is currently unknown, however, it usually fluctuates between. To obtain the decrypter, victims must send their private key (provided in the ransom-demand message) to the email address provided payment instructions are then provided. As mentioned, uses asymmetric encryption and, therefore, two keys (public and private ) are generated during the encryption process.ĭecryption without the private key is impossible, and since this key is stored on remote servers controlled by cyber criminals, victims must purchase it for a specific fee. The ransom-demand message informs victims of the encryption and states that files can only be restored using a unique decryption tool. Both files are placed in every existing folder.

The desktop wallpaper is then modified and two files created: 1) an executable file (' READ_ME!.exe'), which opens a ransom-demand pop-up, and 2) a random file (' 16_random_characters.locked', content unknown). As with Fantom, also displays a fake Windows Update screen during file encryption.įurthermore, this ransomware renames encrypted files using the ' 8_random_characters.locked' pattern (e.g., ' sample.jpg' might be renamed to ' MS5qcGc=.locked').

Once infiltrated, encrypts files using asymmetric cryptography. What is is an new version of Fantom ransomware.

Fotgot my proton email