AeR Ransomware is Based on Dharma Code
AeR, a malicious program affiliated with the Dharma ransomware family, encrypts files and demands ransoms for their decryption.
AeR encrypts files and modifies their names by appending a unique ID assigned to the victim, the email address of the cybercriminals, and a ".AeR" extension. To illustrate, a file originally labeled "1.jpg" transforms into "1.jpg.id-9ECFA84E.[aerossh@nerdmail.co].AeR."
Subsequently, the ransomware generates two separate ransom notes. Text files titled "info.txt" are deposited on the desktop and affected directories, while the other message appears as a pop-up window.
AeR's text file primarily encourages the victim to establish contact with the cybercriminals responsible for the attack. The pop-up window provides more information, explaining that the victim's files have undergone encryption.
Assurances are given regarding the possibility of data recovery, with an implication that decryption requires a ransom payment in Bitcoin cryptocurrency. The victim has the option to test decryption for up to three files at no cost (within specified parameters). The pop-up concludes with explicit warnings.
AeR Ransom Note Uses Dharma Template
The full text of the ransom note generated by the AeR ransomware goes as follows:
All your files have been encrypted!
Don't worry, you can return all your files!
If you want to restore them, write to the mail: aerossh@cock.li YOUR ID -
If you have not answered by mail within 12 hours, write to us by another mail:aerossh@proton.meFree decryption as guarantee
Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 3Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
How Does Ransomware Encrypt Data and Make it Inaccessible?
Ransomware encrypts data to make it inaccessible through a process that involves sophisticated encryption algorithms. Here's an overview of how this typically occurs:
Infiltration: Ransomware gains access to a computer or network through various means, such as phishing emails, malicious attachments, compromised websites, or exploiting software vulnerabilities. Once inside, it begins its encryption process.
Execution: After gaining access, the ransomware executes its code on the victim's system. This often involves the creation of multiple copies of itself and the initiation of processes that allow it to operate stealthily.
Locating Files: Ransomware scans the victim's system to identify specific file types or directories that it intends to encrypt. Some ransomware variants target a wide range of file types, while others focus on specific data, such as documents, images, or databases.
Encryption: Ransomware uses strong and typically asymmetric encryption algorithms, such as RSA or AES, to encrypt the identified files. Asymmetric encryption involves a pair of keys – a public key to encrypt the data and a private key, held by the attacker, to decrypt it. This ensures that only the attacker can decrypt the files.
File Modification: Once encrypted, the ransomware often modifies the file names and adds a specific file extension to indicate that the files are now under its control. The victim may also receive a ransom note explaining the situation and providing instructions on how to pay to get the decryption key.
Communication with Command and Control (C2) Server: In some cases, ransomware communicates with a command and control server controlled by the attacker. This communication may involve sending information about the infected system and receiving instructions on how to proceed with the ransom demand.
