Xash Ransomware Joins Myriad Xash Clones Targeting Files for Encryption
During an examination of malware samples, our team of malware analysts identified Xash as a member of the Djvu ransomware family. Xash operates by encrypting files and renaming them with a ".xash" extension. It also produces a ransom note called "_readme.txt."
For example, the file named "1.jpg" would be renamed to "1.jpg.xash," while "2.png" would become "2.png.xash," and so on. It is worth noting that RedLine and Vidar information stealers are frequently delivered together with Djvu ransomware.
The ransom note created by Xash includes two email addresses, support@freshmail.top and datarestorehelp@airmail.cc. The attackers urge victims to contact them within 72 hours to reduce the cost of the decryption software and key from $980 to $490. The note also states that victims may submit a single encrypted file to the cybercriminals before paying the ransom. However, the encrypted file must not contain valuable information, and it will be decrypted free of charge.
The Xash Ransom Note Escalates Ransom to $980 in Three Days
The full text of the Xash ransom note reads as follows:
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-otP8Wlz4eh
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:
support@freshmail.topReserve e-mail address to contact us:
datarestorehelp@airmail.ccYour personal ID:
How Can You Protect Your Files from Ransomware Like Xash?
Protecting your files from ransomware like Xash requires taking several precautions to minimize the risk of infection and to ensure that your data is backed up and secure. Here are some tips to help you safeguard your files:
- Keep your software up to date: Ensure that all the software on your computer, including your operating system, is up-to-date with the latest security patches. This will help reduce the risk of ransomware exploiting vulnerabilities in outdated software.
- Use a reputable anti-malware program: Install and regularly update a reputable anti-malware program to help protect against ransomware infections.
- Avoid clicking on suspicious links and downloading attachments from unknown sources: Be cautious when clicking on links or downloading attachments in emails, especially if they are from unknown sources or seem suspicious.
- Use strong and unique passwords: Use strong, unique passwords for all your accounts and devices to prevent cybercriminals from gaining access to your system.
- Backup your data regularly: Create backups of your important files regularly, preferably on an external hard drive or cloud-based storage. This way, if your computer is infected with ransomware, you can still recover your files without having to pay the ransom.
By following these steps, you can minimize the risk of ransomware infecting your system and protect your important data from being encrypted and held for ransom.
