Unknown Ransomware is a New Phobos Malware Family Member
We recently ran into a ransomware variant belonging to the Phobos family, dubbed Unknown. This malicious software encrypts files and changes their filenames, adding the victim's ID, an email address, and the ".unknown" extension. For example, "1.jpg" would be renamed to "1.jpg.id . .unknown".
The ransom note in Unknown's text file directs victims to contact masterfix@tuta.io or @Stop_24 on Telegram for further instructions. It also states that the cost of decryption depends on how quickly victims reach out to the threat actors and warns against attempting to decrypt files using third-party software as this may lead to permanent data loss. Victims are offered the chance to send up to five files for free decryption.
Unknown ransomware is particularly dangerous because it modifies filenames and encrypts data without any warning or notification given to victims beforehand. As such, it is important for users to remain vigilant when browsing online and ensure they have adequate security measures in place in order to protect themselves from this type of attack.
Table of Contents
The Unknown ransomware full note
The Unknown ransomware deposits its ransom demands inside two files called "info.hta" and "info.txt". The full text of the note reads as follows:
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail masterfix@tuta.io
Write this ID in the title of your message -
If you do not receive a response within 24 hours, please contact us by Telegram.org account: @Stop_24
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
What is the best way to protect your valuable files against ransomware similar to the Unknown ransomware?
The best way to protect your valuable files against ransomware similar to the Unknown ransomware is to ensure that you have adequate security measures in place. This includes regularly updating your operating system and software, using a reliable antivirus program, and avoiding suspicious websites or links. Additionally, it is important to back up all of your data on an external hard drive or cloud storage service so that if you do become a victim of ransomware, you can restore your files from the backup.
Finally, it is also important to be aware of phishing emails and other malicious activity online as this can be used by cybercriminals to gain access to your system and deploy ransomware.
How can ransomware like the Unknown ransomware find its way on your computer?
Ransomware like the Unknown ransomware can find its way onto your computer through a variety of methods. One of the most common is through malicious emails or links, which can be disguised as legitimate messages from companies or individuals. These emails often contain attachments or links that, when clicked, will download and install the ransomware onto your computer.
Additionally, cybercriminals may also use exploit kits to take advantage of vulnerabilities in outdated software and operating systems to gain access to your system and deploy ransomware. Finally, visiting malicious websites or downloading pirated software can also lead to infection with ransomware like the Unknown ransomware.
