Gayn Ransomware Will Scramble Your Files
When we were examining malware samples, a ransomware called Gayn was detected. This type of malware uses file encryption and adds a ".gayn" extension to filenames, thereby blocking access to them. Additionally, it generates a ransom note called "_readme.txt". For instance, "1.jpg" would become "1.jpg.gayn " and "2.png" would become "2.png.gayn". It is part of the Djvu ransomware family and is usually distributed along with other malware such as RedLine and Vidar.
The ransom note provides instructions on how to contact the attackers and make a partial payment, giving victims two email addresses - support@freshmail.top and datarestorehelp@air mail.cc - and two ransom amounts of $980 and $490. It also encourages victims to get in touch with the attackers within 72 hours for a discounted rate, as well as offering to decrypt one file for free prior to making any payment.
Table of Contents
The Gayn Ransom Note Indicates a Djvu Family Member
The full text of the ransom note used by Gayn reads as follows:
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-ZyZya4Vb8D
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:
support@freshmail.topReserve e-mail address to contact us:
datarestorehelp@airmail.ccYour personal ID:
How Can Ransomware Like Gayn Spread Online?
Ransomware like Gayn can spread through malicious websites, downloads, emails, and other online activities. Many times ransomware is hidden in a seemingly harmless file or email that unsuspecting users download or open. Hackers use a variety of techniques to disguise the ransomware as something legitimate so that it is not detected by anti-virus software.
Another way ransomware like Gayn can be spread is through malicious software that has already infiltrated a computer system. This type of malware can infect other computers on the same network, or it can be spread to other computers through removable media such as USB drives. Additionally, hackers may also use social engineering techniques to trick users into downloading and executing malicious code.
Ransomware attacks have become increasingly common in recent years due to the proliferation of malicious software and the increasing sophistication of hackers. It is important for users to remain vigilant about protecting their online security, especially when downloading files and accessing emails from unknown sources. Installing and regularly updating anti-virus software can help reduce the risk of ransomware attacks. Additionally, users should be aware of phishing scams that often attempt to trick people into clicking malicious links or downloading malicious files.
How To Safely Detect and Remove GAYN Ransomware From Your Computer
