Flash Ransomware is a New Dcrtr Clone

Flash ransomware is a new clone of the Dcrtr ransomware. The discovery of Flash coincided with the emergence of another Dcrtr strain that seems to be closely related to Flash, named simply Ash ransomware.

Flash will encrypt the system and render it largely useless. Encrypted files will receive a new extension, comprised of the email used by the ransomware operator and the ".flash" string. This will turn a file originally called "document.doc" into "document.doc.[ashtray@outlookpro.net].flash".

The Flash ransomware will affect most file types, including executables, media files, documents and archives.

Once the encryption process is over, the ransomware will display a pop-up with its ransom note and drop a shorter version of it inside a text file called "ReadMe_Decryptor.txt". The pop-up window contains the more verbose version of the ransom demands and goes as follows:

To recover data, write here:

1) servicemanager at yahooweb dot co

2) servicemanager2020 at protonmail dot com (if you are Russian, then you need to register on the site www.protonmail.com through the TOR browser hxxps://www.torproject.org/ru/download/ , since the proton is prohibited in your country)

3) Jabber client - servicemanager at jabb dot im (registration can be done on the website - www.xmpp.jp. web client is located on the site - hxxps://web.xabber.com/)

Do not modify files - this will damage them.

Test decryption - 1 file < 500 Kb.