Diamond Ransomware Uses Extremely Long Victim ID

Diamond ransomware is the name of a newly discovered strain of file-encrypting malware. Diamond shows no signs of belonging to a bigger ransomware family.

The new Diamond ransomware encrypts nearly every file on the target system. After encryption, file names are changed to a very long string of random alphanumeric characters and "equals" signs, with the ".diamond" extension appended after the string. Original file names and extensions are destroyed completely, which makes it impossible to tell what the original file was.

The ransomware deposits its random demands inside a plain text file named "HOW TO RECOVER ENCRYPTED FILES.TXT". The ransom note is dropped on the system desktop. The strange thing about this ransomware is that the victim's personal ID key is an extremely long string. Most ransomware variants use a much shorter key, and Diamond's victim ID key is a couple of hundred characters long.

The full ransom note goes as follows:

ALL YOUR DATA IS ENCRYPTED MILITARY ENCRYPTION !

Your PERSONAL id
[long alphanumeric string]

If you want to get a decoder, you need to pay !
We only accept bitcoins !
With your mail diamondprotonmail.com at proton dot me
we can decrypt 2 files proof of !
send us the id that is written in the ransom letter !
write id which is listed in the ransom note !
The price will be doubled in 72 hours !