What is Lilmoon Ransomware?
We discovered Lilmoon, a member of the VoidCrypt ransomware family, while analyzing malware samples submitted to VirusTotal. This ransomware encrypts data and renames files, adding the victim's ID, an email address (encrypt.ns@gmail.com), and the ".lilmoon" extension. For example, a file called "1.jpg" is renamed "1.jpg. (encrypt.ns@gmail.com).lilmoon".
Lilmoon also creates a ransom note in the form of a file called "Dectryption-guide.txt" that explains how the encryption works and instructs victims not to modify files or use any third-party recovery tools as this may result in lost data and key files. It gives two email addresses - encrypt.ns@gmail.com and decrypt.ns@gmail.com - for victims to contact with their case ID and a test file attached to prove that they are real owners of encrypted files in order to receive decryption instructions for restoring their data.
Lilmoon Copies Usual VoidCrypt Ransom Note
The complete text of the Lilmoon ransom note reads as follows:
Your Files Are Has Been Locked
Your Files Has Been Encrypted with cryptography Algorithm
If You Need Your Files And They are Important to You, Dont be shy Send Me an Email
Send Test File + The Key File on Your System (File Exist in C:/ProgramData example : RSAKEY-SE-24r6t523 pr RSAKEY.KEY) to Make Sure Your Files Can be Restored
Get Decryption Tool + RSA Key AND Instruction For Decryption Process
Attention:
1- Do Not Rename or Modify The Files (You May loose That file)
2- Do Not Try To Use 3rd Party Apps or Recovery Tools ( if You want to do that make an copy from Files and try on them and Waste Your time )
3-Do not Reinstall Operation System(Windows) You may loose the key File and Loose Your Files
Your Case ID :
OUR Email :encrypt.ns@gmail.com
in Case of no answer: decrypt.ns@gmail.com
How Can Ransomware Like Lilmoon Infect Your Home Computer?
Ransomware like Lilmoon can infect your home system in various ways. Cybercriminals typically distribute ransomware via malicious websites, email attachments, or drive-by downloads. They may also use malicious links or exploit kits to spread the malware. Additionally, users should be cautious of downloading freeware, software cracks, and torrents as these are often associated with ransomware attacks. It is important to ensure that all of your software is up-to-date and to regularly back up your system so that any encrypted data can be restored if necessary.
