Info Ransomware

The Info ransomware is a new strain of malware that encrypts victim files. The Info ransomware belongs to the family of Dharma ransomware variants.

The Info ransomware will encrypt most widely used extensions on the victim system, including the majority of media, archive and document file types. Once encrypted, files receive a multi-part new extension that consists of the victim's ID, the contact email used by the Info ransomware operators and the string ".info".

This means that a file originally named "document.txt" will transform into "document.txt.id-[alphanumeric string].[infobase@onionmail.com].info.

The ransom note is dropped inside two separate files - one named "Info.hta" and the other a plain text file called "FILES ENCRYPTED.txt".

The .hta file contains the more verbose ransom demand and goes as follows:

'YOUR FILES ARE ENCRYPTED

Don't worry,you can return all your files!

If you want to restore them, follow this link:email infobase at onionmail dot com YOUR ID [alphanumeric string]

If you have not been answered via the link within 12 hours, write to us by e-mail:infobase at msgsafe dot io

Attention!

Do not rename encrypted files.

Do not try to decrypt your data using third party software, it may cause permanent data loss.

Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.'

Of course, contacting criminals or negotiating with them is never a wise choice and offline backups remain the best way to restore files.