Rdptest Ransomware Encrypts Your Files

Rdptest is a type of ransomware. After infiltrating the operating system, Rdptest encrypts and alters the filenames, displaying two ransom notes ("info.hta" and "info.txt"). This specific ransomware is a member of the Phobos family.

Rdptest appends the victim's ID, the email address rdpstresstest@proton.me, and the ".rdptest" extension to the filenames. For example, it transforms "1.jpg" into "1.jpg.id[1E857D00-3449].[Rdpstresstest@proton.me].rdptest," "2.png" into "2.png.id[1E857D00-3449].[Rdpstresstest@proton.me].rdptest," and so on.

The ransom note informs the victim that all their files have been encrypted due to a security issue with their computer. To recover the files, they are directed to contact the attackers via email at rdpstresstest@proton.me, specifying a particular ID in the message title. An alternative email address (rdpstresstest@keemail.me) is provided if there is no response within 24 hours.

Payment for decryption is demanded in Bitcoins, with the amount contingent on how quickly the victim communicates with the attackers. The note offers a complimentary decryption of up to 5 files (total size less than 4Mb) as a guarantee. It also cautions against renaming or attempting third-party decryption to avoid potential data loss or falling victim to scams.

Rdptest Ransom Note Comes in Two Flavors

The longer ransom note produced by Rdptest reads as follows:

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail Rdpstresstest@proton.me
Write this ID in the title of your message 1E857D00-3449
In case of no answer in 24 hours write us to this e-mail:rdpstresstest@keemail.me
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

The ransomware also produces a shorter file named "info.txt", which contains the following brief message:

All of your files are encrypted
To decrypt them send e-mail to this address: Rdpstresstest@proton.me.
If we don't answer in 24h., send e-mail to this address: rdpstresstest@keemail.me

How Can Ransomware Like Rdptest Enter Your System?

Ransomware like Rdptest can enter your system through various means, and understanding these entry points is crucial for implementing effective cybersecurity measures. Here are common ways ransomware can infiltrate a system:

Phishing Emails: The most common method involves phishing emails. Cybercriminals send deceptive emails containing malicious attachments or links. If a user opens the attachment or clicks on the link, the ransomware gets downloaded and executed on the system.

Malicious Websites: Visiting compromised or malicious websites can expose your system to ransomware. Drive-by downloads occur when malware is automatically downloaded and installed on a user's device without their consent, often through vulnerabilities in the browser or plugins.

Malvertising: Malicious advertising, or malvertising, involves cybercriminals placing infected advertisements on legitimate websites. Clicking on these ads can lead to the download of ransomware.

Exploiting Software Vulnerabilities: Ransomware can exploit vulnerabilities in the operating system or installed software. Keeping your software and operating system updated with the latest security patches helps mitigate this risk.

Drive-by Downloads: Unpatched software, especially web browsers, can be exploited to download and install ransomware without the user's knowledge. Regularly updating and patching software is crucial for preventing such attacks.

Infected External Devices: Ransomware can spread through infected external devices such as USB drives or external hard disks. Avoid connecting unknown devices to your computer, and use reliable antivirus software to scan external devices.

Software Downloads from Untrusted Sources: Downloading software or files from untrustworthy sources increases the risk of encountering ransomware. Stick to reputable sources and avoid downloading cracked or pirated software.

Social Engineering: Cybercriminals may use social engineering techniques to trick users into executing malicious actions, such as running a seemingly harmless file or clicking on a disguised link.