2700 Ransomware is a Phobos Clone

The ransomware variant called 2700 is a member of the Phobos family and was discovered during the analysis of new malware samples. This malicious software encrypts files and modifies the file names by appending the victim's ID, email address sqlback@memeware.net, and ".2700" extension. As part of its operation, it generates two ransom notes named "info.txt" and "info.hta."

To illustrate how 2700 alters file names, it transforms "1.jpg" into "1.jpg.id[9ECFA84E-3524].[sqlback@memeware.net].2700," and similarly modifies "2.png" to "2.png.id[9ECFA84E-3524].[sqlback@memeware.net].2700," and so on.

The ransom note directs the victim to establish contact with the attackers via the email address sqlback@memeware.net, specifying a particular ID in the subject of the message. The demand for decryption involves payment in Bitcoins, the amount of which depends on how promptly the victim responds.

Furthermore, the note extends the option of sending up to 2 files for free decryption, provided they are collectively under 2Mb and lack valuable information. It also provides guidance on acquiring Bitcoins, cautions against renaming encrypted files, and advises against attempting decryption using third-party software, emphasizing the potential for permanent data loss.

2700 Ransom Note Copies Phobos Format

The full text of the 2700 ransom note reads as follows:

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail sqlback@memeware.net
Write this ID in the title of your message 9ECFA84E-3524
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 2 files for free decryption. The total size of files must be less than 2Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is the OKX website. You must register, click "Buy Bitcoins" and select a merchant by payment method and price.
hxxps://okx.com
You can also find other places to buy bitcoins and a beginner's guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

How Can You Protect Your Valuable Data from Ransomware?

Protecting your valuable data from ransomware requires a combination of preventive measures, cybersecurity best practices, and a proactive approach to security. Here are some essential steps to safeguard your data from ransomware attacks:

Regular Backups:
Perform regular backups of your important data and ensure they are stored in a secure and isolated environment.
Automate the backup process if possible and verify the integrity of your backups periodically.

Update Software and Systems:
Keep your operating system, software applications, and security solutions up-to-date with the latest patches and updates.
Enable automatic updates whenever possible to ensure timely protection against known vulnerabilities.

Use Reliable Security Software:
Install reputable antivirus and anti-malware software to detect and block ransomware threats.
Consider using endpoint protection solutions that include behavioral analysis and threat intelligence.

Implement Email Security Measures:
Use email filtering solutions to block phishing emails and malicious attachments.
Advise employees not to click on suspicious links or download attachments from unknown or unexpected sources.