MNX 勒索软件是一种新的 Phobos 克隆

MNX 勒索软件是一个新的克隆，它扩展了 Phobos 勒索软件变种家族。

MNX 的行为在很大程度上类似于其他最近的 Phobos 克隆。它会加密连接的系统驱动器上的文件并索要赎金。

加密文件经历了更名，因为 MNX 勒索软件附加了一个冗长的新扩展名，其中包括用户的 ID 字符串、黑客使用的电子邮件和“.MNX”字符串。名为“image.jpg”的文件将变成“image.jpg.id[受害者 ID].[decrypt@techie.com].MNX”。

将在受感染系统上加密的文件类型包括常见的文件、媒体文件、档案和数据库。

一旦勒索软件完成对系统的加密，它就会将勒索要求放入两个名为“info.txt”和“info.hta”的文件中。 HTA 文件显示在一个弹出窗口中，其中包含更详尽的赎金记录版本，内容如下：

All your files have been encrypted!

All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail decrypt at techie dot com

Write this ID in the title of your message -

In case of no answer in 24 hours write us to this e-mail: decrypt123 at sent dot com

You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.

Free decryption as guarantee

Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)

How to obtain Bitcoins

The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.

hxxps://localbitcoins.com/buy_bitcoins

Also you can find other places to buy Bitcoins and beginners guide here:

htxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/

Attention!

Do not rename encrypted files.

Do not try to decrypt your data using third party software, it may cause permanent data loss.

Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.