Kmrox Ransomware is a Phobos Family Member
During the examination of new file sample submissions, our researchers came across another variant of Phobos ransomware called Kmrox. This type of malware falls under the category of ransomware, which is designed to encrypt data and demand payment for its decryption.
On our testing system, Kmrox encoded files and modified their names. The original file names were extended with a unique identification linked to the victim, the email address of the cybercriminals, and a ".kmrox" extension. For instance, a file that was originally labeled as "1.jpg" appeared as "1.jpg.id[9ECFA84E-3489].[exezez@blaze420.it].kmrox," and so forth. Following this, ransom notes were generated through a pop-up window ("info.hta") and a text file ("info.txt").
The ransom messages from Kmrox specify that the files are inaccessible due to encryption. The notes indicate that the only way to recover the files is to purchase the decryption key and software from the cybercriminals. The payment is required in the form of Bitcoin cryptocurrency, although the exact amount is not mentioned in these messages – it's only suggested that the payment might be influenced by how quickly contact is established.
The victim is also given the option of a complimentary decryption test (within specific parameters). The notes conclude with warnings against altering the encrypted data and seeking assistance from third parties.
Kmrox Uses Lengthy Ransom Note
The complete text of the Kmrox ransom note reads as follows:
All your files have been encrypted!
At the moment there is no way to decrypt the data, except to request from us a decryptor and a key with which you will recover all your data.
If you want to restore them, write to us by email: exezez@blaze420.it
Write this ID in the title of your message -
For quick and convenient feedback, write to the online operator in the Telegram messenger: @exezaz
(Be careful when entering the Telegram account name, it must be exactly the same as above, beware of fake accounts.)
Also, from some mail services, your letter may not reach or get into spam, so to increase the likelihood of receiving a quick response, also duplicate your letters to our spare email addresses: helze@cyberfear.com and exezaz@msgden.com
Payment for decryption is made in bitcoins. In order to find out the price, write to the above contacts. The sooner you contact us, the lower the price will be. After payment, we will send you a tool that will decrypt all your files.Free decryption as guarantee
Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)How to obtain Bitcoins
You can buy Bitcoin in any place convenient for you, a beginner's guide is here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/Attention!
To get guaranteed help in decrypting your files, please contact only the contacts listed in this note, because at the moment there are many scammers who,
under the pretext that they can decrypt your data, request a free decryption through us and pass it off as a demonstration that they can decrypt your files.
Remember that the key for decrypting files is individual in each individual case, so you will not be able to decrypt your files yourself using third-party software, it will only spoil your files.
If you want to communicate through an intermediary, then check the price with our operator in advance, since intermediaries often wind up the real price. !!! When contacting third parties,
we do not guarantee the decryption of your files!!!
Also, to avoid problems with decryption, do not rename your files.
What is the Phobos Ransomware Family of Clones?
The Phobos ransomware family consists of a group of ransomware variants that share similar characteristics and methods of operation. These variants are often referred to as "clones" because they are believed to be derived from the same original source code or share a common framework. The Phobos ransomware family is known for encrypting victims' files and demanding a ransom for their decryption.
The Phobos ransomware variants typically exhibit the following characteristics:
- File Encryption: Like most ransomware, Phobos variants encrypt victims' files using strong encryption algorithms, making the files inaccessible without a decryption key.
- Ransom Notes: Phobos ransomware creates ransom notes that inform victims of the encryption and provide instructions on how to pay the ransom to obtain the decryption key.
- Email Contacts: The ransom notes usually include email addresses that victims can use to contact the attackers for further instructions on payment and decryption.
- Unique Extensions: Phobos variants often append unique extensions to encrypted files, making them easily identifiable. These extensions are usually a combination of random characters or identifiers.
- Bitcoin Payments: The ransom demands are typically requested in cryptocurrency, particularly Bitcoin, due to its pseudonymous nature that makes it harder to trace.
- Variability in Ransom Amounts: Different variants of Phobos ransomware may have varying ransom amounts, often depending on factors such as the victim's profile and how quickly they make contact with the attackers.
- Targeted Distribution: Phobos ransomware is commonly distributed through phishing emails, malicious attachments, exploit kits, and other methods used by cybercriminals to spread malware.
- Similar Codebase: Phobos variants share similarities in code and behavior, suggesting a common source or framework that attackers have modified to create different versions.
It's important to note that while Phobos variants share similarities, they can also evolve over time with new features, tactics, and techniques. As with any ransomware, the best defense against Phobos and its variants is a combination of strong cybersecurity practices, regular data backups, keeping software up-to-date, and maintaining a cautious approach to email attachments and links.
