Xrp Ransomware Encrypts Victim Drives

While examining new malware samples, we encountered a ransomware variant known as Xrp, affiliated with the GlobeImposter family. Xrp's primary objective is to encrypt files, appending an email address and the ".xrp" extension to filenames. Additionally, it includes a ransom note ("Read_For_Restore_File.html").

For instance, Xrp alters filenames like "1.jpg" to "1.jpg.[a.wyper@bejants.com].xrp," and "2.png" to "2.png.[a.wyper@bejants.com].xrp," and so on.

The ransom note informs victims that their files have undergone encryption using a robust RSA-2048 algorithm. It asserts that file restoration is impossible without a secret key held by the attackers.

To recover their data, victims are instructed to create an email account with either protonmail.com or cock.li. The note cautions against using a standard email address, as it may be blocked. Subsequently, victims are directed to send an email from the newly established address to a.wyper@bejants.com, including their ID.

The attackers pledge to reply with further instructions on decrypting the files. If there's no response within 48 hours, an alternative email address, a.wyper@worldtravelnotebook.com, is provided.

Xrp Ransom Note Tells Victims to Make New Email Address

The full text of the Xrp ransom note reads as follows:

YOUR FILES ARE ENCRYPTED!
Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm RSA-2048.
Without a secret key stored with us, the restoration of your files is impossible

To start the recovery process:
Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked).
Send a email from your new email address to: a.wyper@bejants.com with your personal ID.
In response, we will send you further instructions on decrypting your files.

Your personal ID:

P.S.
It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.
Сheck the folder "Spam" when waiting for an email from us.
If we do not respond to your message for more than 48 hours, write to the backup email : a.wyper@worldtravelnotebook.com

Q: Did not receive an answer?
A: Check the SPAM folder.
Q: My spam folder is empty, what should I do?
A: Register email box to protonmail.com or cock.li and do the steps above.

How Can Ransomware Infect Your System?

Ransomware can infect a system through various means, and attackers often employ sophisticated techniques to exploit vulnerabilities. Here are common methods through which ransomware can infect your system:

Phishing Emails: One of the most prevalent methods is through phishing emails. Attackers send emails containing malicious attachments or links. Once the user opens the attachment or clicks on the link, the ransomware is downloaded and executed on the system.

Malicious Websites: Visiting compromised or malicious websites can expose your system to ransomware. Drive-by downloads may occur, where malware is automatically downloaded and installed without the user's knowledge or consent.

Malvertising: Attackers use malicious advertisements (malvertising) to distribute ransomware. Legitimate websites may unknowingly display malicious ads, and clicking on these ads can lead to the download of ransomware.

Exploiting Software Vulnerabilities: Ransomware can exploit vulnerabilities in operating systems, software, or applications. If your system is not regularly updated with security patches, it becomes more susceptible to these attacks.

Remote Desktop Protocol (RDP) Attacks: Cybercriminals may attempt to gain unauthorized access to a system through poorly secured Remote Desktop Protocol connections. Once inside, they can deploy ransomware.

Social Engineering: Attackers may use social engineering techniques to trick users into running malicious scripts or downloading infected files. This can include deceiving users into granting unnecessary permissions or running seemingly harmless applications.

Watering Hole Attacks: In this type of attack, cybercriminals compromise websites that are frequently visited by the target audience. When users visit these sites, they unknowingly download malware, including ransomware.

Infected Software Installers: Malicious software installers, often disguised as legitimate applications or updates, can deliver ransomware when executed.