What is the KoRyA Ransomware?
KoRyA is a type of ransomware that belongs to the Xorist family. It was discovered by malware researchers while examining samples submitted to online threat databases. KoRyA encrypts data and adds the ".KoRyA" extension to filenames, changes the desktop wallpaper, creates a text file titled "HOW TO DECRYPT FILES.txt", and displays an error message.
The ransom note in the wallpaper, text file, and error message all state that victims must pay 0.06 BTC (Bitcoin cryptocurrency) to the provided wallet address and then email korya@tuta.io for decryption tools. Victims have two days to make payment before their decryption keys are deleted.
When KoRyA is active on a system, it will modify filenames by adding the ".KoRyA" extension at the end of each one; for example, "1.jpg" would become "1.jpg.KoRyA", "2.png" would become "2.png.KoRyA", and so forth. Furthermore, it will change the desktop wallpaper with a ransom note demanding payment of 0.06 BTC in order to receive decryption tools from korya@tuta .io.
The full ransom note displayed by KoRyA reads as follows:
ATTENTION!
All your files have been encrypted
And their decryption will cost you 0.06 bitcoin.
To start the decryption process follow the steps below
Step 1) Make sure you send 0.06 bitcoin to this wallet:
bc1q73lm30rgv6h9wy42y88t0r8prjh9l9pzpvvm9c
Step 2) Contact me at this email address: korya@tuta.io
With this Subject: -
After the payment has been confirmed,
you will receive the decryptor and the keys for decryption!
Other information:
If you don't own bitcoin, you can buy it here very easily
www.coinmama.com
www.bitpanda.com
www.localbitcoins.com
www.paxful.com
You can find a larger list here:
hxxps://bitcoin.org/en/exchanges
If the payment is not made in 2 days, I will consider that you do not want to decrypt your files,
and therefore the keys generated for your PC will be permanently.deleted.
Paying ransomware actors is not a good idea for several reasons. Firstly, there is no guarantee that the attackers will actually provide the decryption tools after payment. Even if they do, there is no guarantee that the tools will work as promised. Furthermore, paying the ransom only encourages the attackers to continue their malicious activities and target more victims in the future.
Additionally, it sends a message to other cybercriminals that ransomware attacks are profitable and can be used as an effective way to make money. Finally, paying a ransom could also be illegal depending on where you live or where the attackers are located. For these reasons, it is best to avoid paying ransomware actors and instead focus on preventing such attacks from occurring in the first place by taking appropriate security measures.
