FARGO Ransomware
A new variant belonging to the TargetCompany ransomware family was spotted in the wild only recently. The new ransomware strain is called the FARGO ransomware.
FARGO will encrypt files on the infected system, rendering them useless. Affected files include the majority of widely used media, document and archive file types.
Once encrypted, files affected by the FARGO ransomware receive the ".FARGO" extension, hence the name of the malware. This means that a file originally named "picture.jpg" will become "picture.jpg.FARGO" once it has been fully encrypted by the ransomware.
The ransom note is dropped inside a file called "FILE RECOVERY.txt", with the file located on the desktop. There is no mention of a ransom sum in the note, just contact information for possible negotiations. Of course, negotiating with criminals is never advisable.
Here is the full text of the ransom note:
YOUR FILES ARE ENCRYPTED !!!
TO DECRYPT, FOLLOW THE INSTRUCTIONS:
To recover data you need decrypt tool.
To get the decrypt tool you should:
1.In the letter include your personal ID! Send me this ID in your first email to me!
2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files!
3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool!
4.We can decrypt few files in quality the evidence that we have the decoder.
Do not rename, do not use third-party software or the data will be permanently damaged
CONTACT US:
mallox at stealthypost dot net
If first email will not reply in 24 hours then contact with reserve address:
recohelper at cock dot li
YOUR PERSONAL ID:
