Yesterday, a ransomware hit my PC. I didn't pay the ransom and didn't comply with what the attackers were asking for and I wiped everything and every drive on my PC and then reinstalled my stuff from a backup I made previously so everything is fine. But before I wiped everything, I backed up some of the files that were encrypted by the ransomware to try and analyze them later. Now that everything is working as before, I am interested to know which ransomware infected my PC.
In every directories of my computer it created a file named
+README-WARNING+.txt which contained the following text:
::: Greetings :::
.1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen.
.2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay us.
.3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our >interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.
.5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.
.6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.
:::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Does anyone recognize this ransomware? I don't see any names in it and therefore I don't know to whom it could belong.
The wallpaper was replaced with an image saying that my PC was hacked and I had to pay to get my data back but I didn't see anywhere an executable file to decrypt the files or pay the ransom or anything like that.