Toa Ransomware is a New Chaos Clone
A new ransomware variant based on Chaos ransomware code was recently spotted in the wild. The new strain is called the Toa ransomware.
The Toa ransomware exhibits behavior that is largely in line with other Chaos clones. It encrypts files on the victim system, leaving them unopenable. Encrypted files receive a randomly generated new extension made up of four alphanumeric characters. This means that a file originally named "document.doc" will transform into something similar to "document.doc.b3ov" once it has been encrypted by Toa.
The ransomware affects the majority of widely used database, archive, document and media file extensions. Once encryption completes, Toa deposits its ransom note inside a plain text file called "read_it.txt" and asks for a payment of $274, made in Bitcoin, to allegedly provide the victim with a decryption tool. Of course, there is no guarantee that this tool will be sent back to the victim.
The full text of the ransom note is as follows:
Your Windows PC is infected with the Toa Ransomware. Without the key, files can't, and won't, be returned. However, you can get yourself out of this mess. By buying our decryptor software. you can return all of your infected files. The price for this software is $274 in USD. payment can be made in BTC only. If you don't know how to get Bitcoin, Google how. once payment is recevied, a email will contact you and send you the decrypter. If you dont get the decryptor, check your spam folder. Windows Recovery is disabled and all Shadow Copies are deleted as well as the backup catalog. Once you sent the Bitcoin, from the email that infected you, send them your Public Key.
Public Key: -
BTC Adress: [alphanumeric string]
