Dx31 Ransomware is a Phobos Variant
During our analysis of new malicious file samples, we identified Dx31 as ransomware belonging to the Phobos family. Upon activation, Dx31 encrypts data, changes filenames for all encrypted files, and presents two ransom notes ("info.hta" and "info.txt").
Dx31 adds the victim's ID, an email address, and the ".dx31" extension to filenames. For example, it transforms "1.jpg" into "1.jpg.id[9ECFA84E-3449].[dx31@mail.com].dx31", and "2.png" into "2.png.id[9ECFA84E-3449].[dx31@mail.com].dx31".
The ransom note follows a common pattern associated with ransomware attacks, notifying the victim of file encryption due to an alleged security issue with their computer. The message instructs the victim to contact the attackers via email at dx31@mail.com, emphasizing the inclusion of a specific ID in the email subject.
Alternatively, another email address (dx31@usa.com) is provided for contact if there is no response within 24 hours. The demand for payment in Bitcoins for file decryption is present, with the ransom amount left unspecified, dependent on the speed of the victim's response.
To establish credibility, the attackers offer to decrypt up to 5 files at no cost, with conditions related to file size and content. The note also provides guidance on obtaining Bitcoins and cautions against renaming encrypted files or using third-party decryption services to avoid potential scams or increased ransom fees.
Dx31 Ransom Note in Full
The full text of the Dx31 ransom note reads as follows:
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail dx31@mail.com
Write this ID in the title of your message -
In case of no answer in 24 hours write us to this e-mail:dx31@usa.com
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
What is the Phobos Family of Ransomware Variants?
The Phobos family is a group of ransomware variants known for their malicious activities in encrypting files on victims' computers and demanding a ransom for decryption. Here are key characteristics of the Phobos ransomware family:
File Encryption: Like other ransomware variants, Phobos encrypts the files on a victim's system, making them inaccessible. Common file types such as documents, images, videos, and more are targeted.
Ransom Notes: After encrypting the files, Phobos typically leaves ransom notes on the victim's system. These notes contain instructions on how to contact the attackers, details on the ransom payment, and sometimes include the victim's unique ID or other identifiers.
Communication Channels: Phobos often establishes communication channels through email addresses provided in the ransom notes. Victims are instructed to reach out to these email addresses to negotiate payment and receive instructions on how to decrypt their files.
Variants and Evolutions: The Phobos family may have multiple variants or evolve over time with new features or tactics. These variations may have similarities in their core functionalities but could differ in terms of encryption algorithms, ransom note content, or methods of distribution.
Payment in Cryptocurrency: Like many ransomware strains, Phobos typically demands payment in cryptocurrency, commonly Bitcoin. This is because cryptocurrencies provide a degree of anonymity for the attackers during financial transactions.
Targeted Attacks: Phobos attacks can be indiscriminate, affecting individuals, businesses, or organizations. The attackers may use various distribution methods, such as phishing emails, exploit kits, or vulnerabilities in software, to infect systems.
Double Extortion: Some versions of Phobos, like other modern ransomware strains, engage in double extortion tactics. In addition to encrypting files, attackers may threaten to leak sensitive information unless the ransom is paid, adding another layer of pressure on the victims.
