What is the MrWhite Ransomware?
We recently ran into a malicious program called MrWhite, which belongs to the VoidCrypt ransomware family. After launching it on our test system, we noticed that it encrypted files and changed their names by adding a unique ID, the cyber criminals' email address, and a ".MrWhite" extension.
Once the encryption process was finished, MrWhite created a ransom note in a text file titled "Dectryption-guide.txt". This message informed victims that their files had been locked and provided instructions on how to contact the attackers. It also warned against attempting to modify or rename the encrypted data or reinstalling the operating system as this could lead to permanent data loss.
MrWhite is an example of ransomware – malicious software designed to encrypt files and demand payment for their release. Victims are usually asked to pay in in crypto, for example using Bitcoin, in order to receive a decryption key from the attackers.
It is important to be aware of ransomware threats and take steps to protect themselves from them. This includes regularly backing up important data, keeping anti-virus software up-to-date, avoiding suspicious emails and websites, and being cautious when downloading files from the internet.
Table of Contents
The MrWhite ransom demands note
The full ransom note used by MrWhite goes as follows:
Your Files Are Has Been Locked
Your Files Has Been Encrypted with cryptography Algorithm
If You Need Your Files And They are Important to You, Dont be shy Send Me an Email
Send Test File + The Key File on Your System (File Exist in C:/ProgramData example : RSAKEY-SE-24r6t523 pr RSAKEY.KEY) to Make Sure Your Files Can be Restored
Get Decryption Tool + RSA Key AND Instruction For Decryption Process
Attention:
1- Do Not Rename or Modify The Files (You May loose That file)
2- Do Not Try To Use 3rd Party Apps or Recovery Tools ( if You want to do that make an copy from Files and try on them and Waste Your time )
3-Do not Reinstall Operation System(Windows) You may loose the key File and Loose Your Files
Your Case ID :-
OUR Email :imsystemsavior@gmail.com
in Case of no answer: backupsystemsavior@proton.me
How does ransomware like MrWhite spread?
Ransomware like MrWhite can spread in a variety of ways, including malicious email attachments, malicious links sent via social media or instant messaging platforms, and through compromised websites. It is also possible for ransomware to be installed on a computer when users download software from untrustworthy sources. Additionally, attackers may use exploit kits to take advantage of vulnerabilities in outdated software and operating systems.
To protect against ransomware attacks, it is important to keep all software up-to-date and install security patches as soon as they become available. Users should also avoid clicking on suspicious links or downloading files from unknown sources. Additionally, it is important to regularly back up data so that if an attack does occur, the user will have access to their files even if they are encrypted by ransomware.
Why paying ransom money to hackers is not a good idea?
Paying ransom money to hackers is not a good idea for several reasons. Firstly, there is no guarantee that the hacker will actually provide the decryption key or unlock the files once payment has been made. In some cases, victims have paid the ransom only to find out that their files remain encrypted and they have lost their money.
Secondly, paying ransom money encourages cyber criminals to continue their activities as it provides them with financial incentive. This can lead to more ransomware attacks in the future, which could potentially affect more people.
Finally, paying ransom money may also be illegal depending on where you live and could result in criminal charges being brought against you. It is important to remember that ransomware is a form of extortion and should be reported to law enforcement authorities if you are a victim of an attack.
In conclusion, paying ransom money to hackers is not recommended as it does not guarantee that your files will be unlocked and can encourage further malicious activity from cyber criminals. It is important to take steps to protect yourself from ransomware attacks by keeping all software up-to-date and regularly backing up important data.
