RPC Ransomware is a New Dharma Variant Prone To Encrypt Documents and Other Files

RPC ransomware is the name of a newly discovered ransomware clone that belongs to the family of Dharma ransomware variants.

The new strain encrypts files on the system it executes on, making all encrypted files unreadable. Affected file types include executables, media files, documents and archives.

Once a file is encrypted by the RPC ransomware, it receives a new extension that contains the victim ID string, the email of the hackers running RPC and the ".RPC" string. This will turn a file called "document.txt" into "document.txt.id-VICTIM ID.[pcrec@tuta.io].RPC".

The ransomware deposits its ransom note inside a file called "recinfo.txt" and displays a longer version of it in a pop-up window. The full ransom note shown in the pop-up window goes as follows:

FILES ENCRYPTED

Don't worry, you can return all your files!

If you want to restore them, write to the mail: pcrec@tuta.io YOUR ID -

If you have not answered by mail within 12 hours, write to us by another mail:pcrec at cock dot li

ATTENTION

We recommend you contact us directly to avoid overpaying agents

Do not rename encrypted files.

Do not try to decrypt your data using third party software, it may cause permanent data loss.

Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.