Dxen Ransomware Locks Most Files

Dxen has been identified as a form of ransomware. It belongs to the Phobos ransomware family, which typically encrypts files and demands payment for decryption.

Upon testing Dxen on our system, it encrypted files and modified their names by appending a distinctive ID assigned to the victim, the attackers' email address, and a ".dxen" extension. For instance, a file originally named "1.jpg" would appear as "1.jpg.id[9ECFA84E-3536].[vinsulan@tutanota.com].dxen" after the encryption process.

Following the encryption, ransom messages were generated in both a pop-up window ("info.hta") and a text file ("info.txt"). These files were placed in all encrypted directories and on the desktop. The text file from Dxen ransomware conveys that the victim's data has been encrypted and urges them to contact the attackers for decryption.

The pop-up window provides additional details about the ransomware infection, indicating that decryption necessitates the payment of a ransom in Bitcoin cryptocurrency. While the specific amount is not specified, it is suggested to be dependent on how promptly the victim initiates contact. Before transferring funds, the victim is allowed to test the decryption on up to five files for free.

The note concludes with warnings, advising the victim against renaming the encrypted files or using third-party decryption software, as these actions may result in permanent data loss.

Dxen Ransom Note Applies Phobos Layout

The full text of the Dxen ransom note reads as follows:

All your files have been encrypted!

All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail vinsulan@tutanota.com
Write this ID in the title of your message -
In case of no answer in 24 hours write us to this e-mail:vinsulan@cock.li
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.

Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)

How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/

Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

How Can You Safeguard Your Drives Against Ransomware Attacks?

Protecting your drives against ransomware attacks requires a combination of proactive measures and cybersecurity best practices. Here are some effective ways to safeguard your drives from ransomware:

Backup Regularly:
Regularly back up your important data to an external drive or a secure cloud service. Ensure that backups are stored offline or in a separate, isolated network to prevent ransomware from reaching them.

Update Software and Operating System:
Keep your operating system, antivirus software, and all applications up to date. Regular updates often include security patches that can protect your system from known vulnerabilities.

Use Reliable Security Software:
Install reputable antivirus and anti-malware software and keep it updated. Regularly scan your system for malware and ensure real-time protection is enabled.

Enable Automatic Updates:
Turn on automatic updates for your operating system and software. This helps ensure that you receive the latest security patches promptly.