BlackToxic Ransomware
BlackToxic is the name of a new strain of ransomware. According to researchers, the new variant is a member of the Chaos ransomware family.
BlackToxic will encrypt popular file types on the target system, leaving the files in an unreadable state. The majority of widely used media, document, archive and database file types are targeted, with system-essential files left intact.
Once BlackToxic encrypts a file, it appends the ".KsiRu0w2" extension past the original one. This means that a file that was formerly called "essay.docx" will turn into "essay.docx.KsiRu0w2" once it has been encrypted.
The ransom note is dropped in a plain text file called "read_it.txt", threatening that files will be leaked if the ransom is not paid within 48 hours. Curiously, the note never mentions the amount of crypto the hackers expect to receive to allegedly send a decryption tool - a prospect that is as uncertain as making any deal with a criminal.
The full ransom note of the BlackToxic ransomware goes as follows:
+ ( (:{You Been Hit By The BlackToxic RansomNote}:) )
========================================= ========================================
To get your files back you must pay in btc dont delete this ransom or else your files wil be gone
========forever!!!!!!!!=========== also your files will be recoverd when you pay the blacktoxic
=======> ramsomnote<========= and your files will be uploaded to our database
this could be the fBI or someone spying in you as a hitman if you dont want this to happen you must
++ pay our ransomenote to this address in btc only!!!!
=================>[alphanumeric string] <=================
========================================= ========================================
Hacked+By+BGT-BlackToxicRansome=================Note
you must pay within 48hrs or your files is not going to be recoverd by this ransome unless you pay
otherwise as we have the decryption key that will help you to revover your important files!!!!!!!
