3AM Ransomware Locks Victim Files

3AM is a ransomware program coded in the Rust programming language. Its primary objective is to encrypt files. Once the encryption process is completed, it attempts to erase Volume Shadow (VSS) copies. Additionally, 3AM adds the ".threeamtime" extension to the filenames of the encrypted files and presents a ransom message named "RECOVER-FILES.txt."

To illustrate how 3AM alters filenames, it transforms "1.jpg" into "1.jpg.threeamtime," "2.png" into "2.png.threeamtime," and so on. The ransom note contained within the "RECOVER-FILES.txt" file informs victims that their files have been encrypted, and their systems may appear non-operational with backups no longer accessible. The note strongly advises against attempting self-restoration, highlighting the risk of further data loss and irrecoverable damage.

Furthermore, the note discloses that sensitive data from a local network has been pilfered, encompassing financial records, personal details, work-related documents, and more, with an assurance of confidentiality to prevent harm to businesses. The note suggests initiating negotiations to prevent the sale of data on the dark web, providing contact information via the Tor browser and referring to an access key for negotiation.

3AM Ransom Note Mentions no Ransom Sum

The complete text of the 3AM ransom note goes as follows:

Hello. "3 am" The time of mysticism, isn't it?

All your files are mysteriously encrypted, and the systems "show no signs of life", the backups disappeared. But we can correct this very quickly and return all your files and operation of the systems to original state.

All your attempts to restore data by himself will definitely lead to their damage and the impossibility of recovery. We are not recommended to you to do it on our own!!! (or do at your own peril and risk).

There is another important point: we stole a fairly large amount of sensitive data from your local network: financial documents; personal information of your employees, customers, partners; work documentation, postal correspondence and much more.

We prefer to keep it secret, we have no goal to destroy your business. Therefore can be no leakage on our part.

We propose to reach an agreement and conclude a deal.

Otherwise, your data will be sold to DarkNet/DarkWeb. One can only guess how they will be used.

Please contact us as soon as possible, using Tor-browser:

Access key:

How is Ransomware Like 3AM Distributed?

Ransomware like 3AM is typically distributed through various methods and attack vectors. Here are some common distribution methods:

• Phishing Emails: Cybercriminals often use phishing emails to distribute ransomware. They send malicious emails that appear legitimate, often impersonating trusted entities or using enticing subject lines. These emails contain malicious attachments or links that, when clicked or opened, download and execute the ransomware on the victim's device.
• Malicious Attachments: Ransomware can be spread through email attachments, such as infected documents (e.g., Word or PDF files) or executable files (e.g., .exe or .js files). When the victim opens these attachments, the ransomware payload is activated.
• Malvertising: Malicious advertisements (malvertising) on websites or online ads can lead users to websites hosting exploit kits. These kits can take advantage of vulnerabilities in the victim's web browser or plugins to deliver ransomware.
• Drive-By Downloads: Cybercriminals may compromise legitimate websites and inject malicious code into them. When users visit these compromised sites, their devices can become infected without any interaction required.
• Remote Desktop Protocol (RDP) Attacks: If RDP is enabled and not properly secured on a victim's system, attackers may attempt to gain access by guessing weak passwords or using brute force attacks. Once inside, they can manually deploy ransomware.
• Software Vulnerabilities: Ransomware authors may exploit known vulnerabilities in operating systems or software to gain access to a victim's system. Keeping software and systems up to date with security patches can help mitigate this risk.
• Malicious Links: Cybercriminals may also distribute ransomware through social engineering tactics on social media, instant messaging platforms, or by tricking users into clicking on malicious links.
• USB and Removable Media: Ransomware can spread via infected USB drives or other removable media. When a user inserts an infected drive into their computer, the ransomware can execute and start encrypting files.