What is SRC Ransomware?

SRC Ransomware is a malicious infection from the Makop family. This particular ransomware encrypts files upon infecting a system and alters filenames by appending a unique victim ID, the email address "restoreBackup@cock.li," and the ".SRC" extension. For instance, "1.jpg" is renamed to "1.jpg.[2AF20FA3].[RestoreBackup@cock.li].SRC" and so on. SRC Ransomware also changes the desktop wallpaper and leaves a ransom note labeled "+README-WARNING+.txt."

SRC Ransomware Infection Symptoms

The ransom note left by SRC informs victims that their files have been encrypted, although the file structure is preserved to avoid data corruption. It demands payment for decryption and offers to decrypt two sample files to prove they can actually do it. The note provides the email address "restoreBackup@cock.li" and a TOX ID for contacting the attackers. It also warns against modifying or decrypting the files using third-party tools, as this could lead to permanent data loss.

Here's an example of the SCR Ransomware's ransom note:

::: Greetings :::

Little FAQ:

.1.
Q: Whats Happen?
A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen.

.2.
Q: How to recover files?
A: If you wish to decrypt your files you will need to pay us.

.3.
Q: What about guarantees?
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.
To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.

.4.
Q: How to contact with you?
A: You can write us to our mailbox: RestoreBackup@cock.li
Or you can contact us via TOX: -
You don't know about TOX? Go to hxxps://tox.chat

.5.
Q: How will the decryption process proceed after payment?
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.

.6.
Q: If I don t want to pay bad people like you?
A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.

:::BEWARE:::
DON'T try to change encrypted files by yourself!
If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Other SRC Ransomware Details

Once ransomware like SRC encrypts files on a system, those files become inaccessible without a decryption tool typically held only by the attackers. Paying the ransom is highly risky, as there's no guarantee that the attackers will give you the decryption key. In some cases, free decryption tools may be available online. Restoring files from backups can also negate the need to pay the ransom. Removing the ransomware promptly is crucial to prevent it from spreading to other connected systems or encrypting additional files.

What is Ransomware

Ransomware attacks generally involve encrypting a victim's data and demanding a ransom for decryption. Most ransomware also renames the files it encrypts. Attackers usually require payment in cryptocurrency. Examples of other ransomware variants include EMBARGO Ransomware, Anyv Ransomware, and ZHO Ransomware. To protect against data loss in an attack, it is important to keep backups of essential files on a cloud or an offline storage device.

Ransomware Infection Methods

Ransomware can infiltrate a system through various means. Standard methods include phishing emails with malicious attachments or links and malicious online advertisements. Cybercriminals also exploit vulnerabilities in outdated software or operating systems. Other infection vectors include pirated software, cracking tools, compromised USB drives, downloads from peer-to-peer (P2P) networks, unofficial websites, and third-party downloaders. Technical support scams are another tactic used to distribute malicious software.

Protection Against Ransomware

To protect against ransomware infections, download applications and files from reliable sources such as official websites or app stores. Avoid using pirated software or cracking tools. Be cautious with emails containing suspicious links or attachments. Do not interact with dubious websites' ads, pop-ups, or download buttons. Regularly update your operating system and installed applications, and scan your computer for threats. Using reputable security software can enhance your protection against such threats.