ORCA Ransomware
ORCA is a new ransomware variant that belongs to the ZEPPELIN family of ransomware clones.
ORCA will render a victim system encrypted, leaving only files essential to the operation of the OS untouched. Encrypted file types will include documents, media, archive and databases.
Once encrypted by ORCA, files receive a new long extension that consists of the ".ORCA" string and the victim's ID string. For example, a file named "image.jpg" will turn into "image.jpg.ORCA.[victim ID]".
The ransom demands are deposited inside a file named "HOW_TO_RECOVER_DATA.hta". The file is placed on the system desktop. The contents of the ransom note include an attempt at double extortion. The full note goes as follows:
YOUR FILES HAVE BEEN ENCRYPTED
Your ID to decrypt: -
Contact us: GoldenSunMola at aol dot com | GoldenSunMola at cyberfear dot com
Unfortunately for you, due to a serious vulnerability in IT security, you are vulnerable to attacks!
To decrypt files, you need to get a private key.
The only copy of the secret key that can be used to decrypt files is on a private server.
The server will destroy the key within 72h after the encryption is completed.
To save the key for a longer period, you can contact us and provide your ID!
In addition, we collect strictly confidential/personal data.
This data is also stored on a private server.
Your data will be deleted only after payment!
If you decide not to pay, we will publish your data to everyone or resellers.
So you can expect your data to become publicly available in the near future!
It's just a business and we only care about making a profit!
The only way to get your files back is to contact us for further instructions!
To establish a trust relationship, you can send 1 file for test decryption (no more than 5 MB)
Do not waste your time searching for other decryption methods - THERE ARE NONE, you will pay more for your time!
Every day the price of decryption increases!
Do not rename encrypted files.
Do not use third-party programs to decrypt files - they can only do harm!
After payment, you get a decoder (.exe), you only need to run it, and it will do everything by itself.
I only accept Bitcoins! You can learn how to buy them on the Internet.
