Gachimuchi Ransomware
Gachimuchi is the name of a new ransomware strain that was spotted in the wild recently.
Gachimuchi encrypts most files on the target system and appends a multi-part complex extension once encryption completes. The ransomware affects media, document, archive and database file types. Once encrypted, the files receive three strings following their original name and extension, consisting of the victim's ID, the name Billy Herrington and the name of the ransomware.
This means that a file that was previously called "document.txt" will turn into "document.txt.[ID string].[BillyHerrington].Gachimuchi. In most cases the second appended string is used for the contact email employed by the malware operators. Why Gachimuchi opted for the name Billy Herrington in that spot is a mystery.
The ransomware drops its ransom demand in a plain text file named "#HOW_TO_DECRYPT#.txt". The full note goes as follows:
'ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
========================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
========================
To receive the private key and decryption program follow the instructions below:
1. Write to our skype - Gachimuchi DECRYPTION
Also you can write ICQ live chat which works 24/7 @Gachimuchi
Install ICQ software on your PC hxxps://icq.com/windows/ or on your mobile phone search in Appstore / Google market ICQ
Write to our ICQ @Gachimuchi hxxps://icq.im/Gachimuchi
If we not reply in 6 hours you can write to our mail but use it only if previous methods not working - gachimuchi at onionmail dot org
2. Our company values its reputation. We give all guarantees of your files decryption,such as test decryption some of them
We respect your time and waiting for respond from your side
tell your MachineID: - and LaunchID: -'
