FLSCRYPT Ransomware is a New Phobos Clone
FLSCRYPT is the name of a newly discovered ransomware strain that belongs to the Phobos family of ransomware variants.
FLSCRYPT encrypts files as expected, affecting most popular extensions and leaving files unreadable. Encrypted files receive a new extension made up of multiple parts, containing the victim ID string, the contact email used by the malware operator and the ".FLSCRYPT" string.
This means that a file originally named "document.txt" will turn into "document.txt.id[alphanumeric string].[decrypt2022@onionmail.ogr].FLSCRYPT".
The ransom note is deposited inside a couple of files with the same name, one plain text and one .HTA file, both named "info". The full text of the note is as follows:
Hello my dear friend. All your files have been encrypted!
Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted. The only method of recovering files is to purchase decrypt tool and unique key for you.
If you want to recover your files, write us to this e-mail: decrypt2022@onionmail.org In case of no answer in 24 hours write us to this e-mail:decrypt2022@msgsafe.io
Our online operator is available in the messenger Telegram: @Files_decrypt or hxxps://t.me/Files_decrypt
If there is no response from our mail, you can install ICQ software on your PC here hxxps://icq.com/windows/ or on smartphone from Appstore / Google Play Market search for "ICQ"
Write to our ICQ @Ransomware_Decrypt hxxps://icq.im/Ransomware_Decrypt/ Or download the (Session) messenger (hxxps://getsession.org) in messenger: [alphanumeric string]
You have to add this ID - and we will complete our converstion.
Or download the Tox Chat (hxxps://tox.chat/download.html') in messenger: [alphanumeric string] You must add this ID -and write to us.
Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly.
Your Data
Sensitive data on your system was DOWNLOADED.
If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly.
Data includes:
Employees personal data, CVs, DL, SSN.
Complete network map including credentials for local and remote services.
Private financial information including: clients data, bills, budgets, annual reports, bank statements.
Manufacturing documents including: datagrams, schemas, drawings in solidworks format
And more...
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
We are always ready to cooperate and find the best way to solve your problem.
The faster you write - the more favorable conditions will be for you.
Our company values its reputation. We give all guarantees of your files decryption.
