DoctorHelp Ransomware Based on MedusaLocker

Our team discovered DoctorHelp - a piece of malicious software classified as ransomware, belonging to the MedusaLocker family. The primary objective of DoctorHelp is to encrypt files.

Furthermore, DoctorHelp generates a ransom note titled "How_to_back_files.html" and appends the ".doctorhelp" extension to filenames. For example, it alters "1.jpg" to "1.jpg.doctorhelp" and "2.png" to "2.png.doctorhelp," and so forth. The ransom note explicitly conveys that essential files owned by the victim have undergone encryption. The cybercriminals assure the victim that the files remain intact but have undergone alterations using RSA and AES encryption. The note strongly advises against attempting file restoration with third-party software, claiming that such efforts would result in irreversible corruption.

The threat actors assert that they have obtained highly confidential and personal data currently stored on a private server. Allegedly, this server is set for immediate destruction upon receipt of payment. In the absence of payment, the note threatens to disclose the captured data to the public or potential buyers, posing an imminent risk of public exposure.

Additionally, the attackers propose an arrangement wherein the victim can send 2-3 non-essential files for free decryption as a demonstration of their ability to restore files upon payment. The ransom note provides contact details (doctorhelperss@gmail.com and helpersdoctor@outlook.com email addresses) and advises the victim to establish an email account on protonmail.com for communication.

A 72-hour deadline is stipulated, accompanied by a warning that failing to initiate contact within this timeframe will result in an increase in the ransom demand. The message concludes with a suggestion to use Tor-chat for ongoing communication, emphasizing the criminals' commitment to maintaining contact throughout the negotiation process.

DoctorHelp Ransom Note Promises Decryption of a Few Files

The full text of the DoctorHelp ransom note goes as follows:

YOUR PERSONAL ID:

YOUR COMPANY NETWORK HAS BEEN PENETRATED
All your important files have been encrypted!

Your files are safe! Only modified. (RSA+AES)

ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.

No software available on internet can help you. We are the only ones able to
solve your problem.

We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..

We only seek money and our goal is not to damage your reputation or prevent
your business from running.

You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.

Contact us for price and get decryption software.

email:
doctorhelperss@gmail.com
helpersdoctor@outlook.com
To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Tor-chat to always be in touch:

How Do Criminals Distribute Ransomware Online?

Criminals use various methods to distribute ransomware online, taking advantage of vulnerabilities and exploiting human behavior. Here are some common tactics employed by cybercriminals to distribute ransomware:

Phishing Emails:
Cybercriminals often use phishing emails to distribute ransomware. They send emails that appear legitimate, often mimicking trusted entities or services, and include malicious attachments or links. Clicking on these attachments or links can trigger the download and execution of ransomware.

Malicious Links and Websites:
Criminals create malicious websites or inject malicious code into legitimate websites. Users may be directed to these sites through phishing emails, compromised ads, or other deceptive tactics. Visiting such sites can lead to the automatic download and installation of ransomware.

Exploit Kits:
Exploit kits are toolkits that contain pre-written code to exploit vulnerabilities in software. Cybercriminals use these kits to target outdated software on a user's system. When a user visits a compromised website or clicks on a malicious link, the exploit kit identifies and exploits vulnerabilities, allowing the ransomware to be delivered and executed.

Malvertising:
Malvertising involves placing malicious code in online advertisements. When users click on these ads or visit websites hosting them, the malicious code can exploit vulnerabilities in the user's browser or plugins to deliver ransomware.

Social Engineering:
Cybercriminals use social engineering techniques to manipulate users into taking actions that lead to ransomware infection. This can involve tricking users into downloading and executing malicious files or clicking on links through deceptive tactics, such as fake alerts, warnings, or enticing offers.