Erop Ransomware is One More Djvu Variant That Targets Your Files for Encryption

The malware known as Erop has been identified as a member of the Djvu ransomware family. It works by encrypting the victim's files, adding the ".erop" extension, and creating a "_readme.txt" file that holds a ransom note. It was discovered by malware researchers while analyzing submissions to VirusTotal.

Erop renames files by adding the ".erop" extension to the original file name, for example, it changes "1.jpg" to "1.jpg.erop" and "2.png" to "2.png.erop". The ransom note claims that the only way to retrieve the encrypted files is to buy decryption software and a unique key for $980, but with a discount of 50% if the victim contacts the attacker within 72 hours, lowering the cost to $490.

The attacker warns that the files cannot be restored without payment and offers to decrypt one file as a demonstration. The ransom note lists two email addresses for contact: support@freshmail.top and datarestorehelp@airmail.cc.

Table of Contents

The Erop ransom demands and ransom note

The full text of the "_readme.txt" file generated by Erop reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-8pCGyFnOj6
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How can you protect your data from ransomware variants similar to the Erop ransomware?

To protect your data from ransomware variants like Erop, you can follow the following best practices:

Keep software and operating systems up-to-date: Software vulnerabilities can be exploited by ransomware attackers, so it's important to regularly update your software and operating systems.
Use a reputable antivirus software: Antivirus software can detect and prevent many types of malware, including ransomware.
Regularly back up important data: Keeping regular backups of your important data can help you recover it if your computer is infected with ransomware. Store backups on an external hard drive or in the cloud, so they're not accessible to the ransomware.
Be cautious when opening email attachments: Ransomware can be spread via malicious attachments in emails. Be cautious of attachments from unknown or suspicious sources.
Enable your firewall: A firewall can help prevent unauthorized access to your computer and can also block malware from communicating with other computers on the internet.
Avoid visiting suspicious websites and downloading unknown files: Websites that contain malicious code can infect your computer with ransomware. Be careful when downloading files from the internet, especially those with executable extensions like ".exe" or ".msi".
Exercise caution when clicking on links in emails or on websites: Malicious links can redirect you to websites that contain malware or download malware onto your computer.

How is ransomware like Erop usually distributed and delivered on victim systems?

Ransomware like Erop is usually distributed and delivered on victim systems through various methods such as email phishing campaigns, malicious websites, or drive-by downloads. In email phishing campaigns, the attacker sends a seemingly legitimate email with a malicious attachment that, once opened, infects the victim's computer with the ransomware. Malicious websites are used to distribute ransomware when a user visits the site and downloads an infected file. Drive-by downloads occur when a user visits a website that automatically downloads malware onto their computer without their knowledge.

In addition, attackers can also use exploit kits, which are pre-packaged software kits that contain exploits for known vulnerabilities. Once a user visits a compromised website that is hosting an exploit kit, the kit will exploit any vulnerabilities in the user's software and deliver the ransomware.

Once the ransomware has been delivered on a victim's system, it will encrypt their files, making them inaccessible without the decryption key. The attacker then demands payment in exchange for the decryption key, typically through a ransom note that is delivered on the victim's computer. The ransom note usually contains a deadline for payment and a threat to delete the encrypted files if the ransom is not paid.