DASHA Ransomware Lists No Ransom Sum

There is a new variant of the Eternity ransomware family in the wild. The new version is called the DASHA ransomware.

DASHA does everything you would expect from a ransomware threat. It will encrypt the victim system, leaving almost every file scrambled. Encrypted file types include media, document, archive and database files.

Once encrypted, the files receive the ".ecrp" extension appended to them. This will effectively turn a file named "document.txt" into "document.txt.ecrp" after encryption.

DASHA doesn't have the usual ransom note in plain text format as a .txt file like most other ransomwares. Instead, the ransom note is displayed inside a pop-up window and the desktop wallpaper is also changed to an image with more text on it. The pop-up window contains the following text:

All of your files have been ENCRYPTED with DASHA RANSOMWARE
Your computer was infected with a ransomware. Your files have been encrypted and you won't
be able to decrypt them without our help.
What can I do to get my files back?
Contact us
Email: dashasupport at proton dot me
Telegram: hxxps://t.me/dashasupport

The wallpaper reads as follows: