Qxtfkslrf Ransomware Will Scramble Your System

We have recently discovered a new ransomware called Qxtfkslrf. This malicious program belongs to the Snatch ransomware family and operates by encrypting data and demanding payment for its decryption.

During our testing, Qxtfkslrf successfully encrypted files on our test machine and added a ".qxtfkslrf" extension to their filenames. For instance, a file named "1.jpg" would appear as "1.jpg.qxtfkslrf," and "2.png" would become "2.png.qxtfkslrf," applying the same pattern to all affected files.

After completing the encryption process, Qxtfkslrf placed a ransom note titled "HOW TO RESTORE YOUR QXTFKSLRF FILES.TXT" on the desktop. The message explicitly indicates that this ransomware specifically targets companies rather than individual home users.

The ransom note addresses the victim as "management" and reveals that the network has been compromised, resulting in the encryption of inaccessible files. It also claims that over 300 GB of data has been exfiltrated, consisting of confidential documents, personal information, accounting data, and mailbox copies.

The note strongly advises against attempting manual decryption or using third-party recovery tools, as these actions may render the affected files permanently undecryptable. The victim is given a three-day deadline to contact the attackers for further instructions regarding the decryption keys or software. If the deadline passes, the cyber criminals threaten to expose the exfiltrated data by initiating its public release.

Qxtfkslrf Ransom Note Indicates Hackers Target Businesses

The full text of the Qxtfkslrf ransom note reads as follows:

Dear Management -

We inform you that your network has undergone a penetration test, during which we encrypted your files and downloaded more than 300 GB of your data including:
Accounting
Confidential documents
Personal data
Copy of some mailboxes

Important!
Do not try to decrypt the files yourself or using third-party utilities.The only program that can decrypt them is our decryptor, which you can request from the contacts below. Any other program will only damage files in such a way that it will be impossible to restore them.

You can get all the necessary evidence, discuss with us possible solutions to this problem and request a decryptor by using the contacts below
Please be advised that if we don't receive a response from you within 3 days, we reserve the right to publish files to the public.

Contact us:
sandromanadro@mail.com or TOX: 3DB2B2FA4940D92254E6361B375C761 62918AA7586FCA3813B56BDBE598A9D5251410B91826D

How is Ransomware Like Qxtfkslrf Commonly Distributed?

Ransomware like Qxtfkslrf is commonly distributed through various methods, taking advantage of different attack vectors. Here are some common distribution techniques employed by ransomware:

• Email phishing campaigns: One of the most prevalent methods is through phishing emails. Attackers send deceptive emails that appear legitimate, often posing as reputable organizations or containing enticing offers. These emails may include infected attachments or malicious links that, when clicked or opened, initiate the ransomware download.
• Malicious attachments: Ransomware can be distributed through email attachments, such as Word documents, PDF files, or executable files. These attachments may be disguised as invoices, receipts, resumes, or other seemingly harmless documents. Once the attachment is opened, the ransomware payload is executed.
• Drive-by downloads: Attackers exploit vulnerabilities in websites or inject malicious code into legitimate websites to initiate drive-by downloads. When a user visits an infected website or clicks on a compromised advertisement, the ransomware is automatically downloaded and executed on their system.
• Exploit kits: Cybercriminals utilize exploit kits, such as Rig, Fallout, or Spelevo, to identify and exploit vulnerabilities in software installed on target systems. When a user visits a compromised website or clicks on a malicious link, the exploit kit scans for vulnerabilities and delivers the ransomware payload.