Tutorials

A long time back in 2017, the world of Mac experienced a new threat - FindZip Ransomware. It was found disguised as cracks for Adobe Premiere Pro and Microsoft Office promoted on piracy websites. When you open the downloaded file, you will be presented with a transparent window. FindZip does not infect users by force. To launch the encryption, you have to click on the "Start" button. Then, the client starts imitating the cracking process, which will turn your desktop into an encrypted mess. All files are getting ciphered using the zip folders to contain files with the .crypt extension. Amazingly, the encryption keys created by FindZip are not stored on the hacker's server. Even after sending 0.25 BTC to purchase the decryption key, you will not receive any promised tools to recover the data. Interestingly, the virus acts uncertainly, it does not touch Time Machine backups and external devices as well. Even though FindZip used strong algorithms at that time, experts from Malwarebytes laboratory found a way to decrypt files without permanent loss.

Tomas is a high-risk threat, classified as ransomware. Using special algorithms, infections of such type encrypt personal data and demand money from victims. Tomas is not an exception, it targets various kinds of data including images, videos, text files, and other valuable sorts. When Tomas appears on your system, it disables protectionary services and activates the encryption of data. During the process, the virus changes the stored files beyond recognition. For instance, a file like 1.mp4 will be changed using a long string of symbols like this 1.mp4.[E3CEFA3F].[tomasrich2020@aol.com].tomas. This model consists of the original filename, personal ID, cybercriminal's email address, and the .tomas extension to finish. After the process is done, Tomas creates a note called readme-warning.txt that states how to decrypt your data. Cybercriminals are trying to wind you down after such a big loss saying that your files can be decrypted. The only thing required to do is buying a decryption key that may cost you over a monthly salary - approximately 3000 dollars, which are accepted only in Bitcoin.

Back in 2016, KeRanger became the very first ransomware that attacked Mac users. Most users were mind-blown when realized that their data is locked because they downloaded a legitimate BitTorrent Client called Transmission. At that time, cybercriminals managed to hack their website and ingrain a file-encrypting virus into a new version that was about to come out. Therefore, users inadvertently caught a malware attack by updating the previously installed application. Unfortunately, laboratories have not identified the appropriate measure to decrypt the inflicted data. Instead, victims offer a paid solution which is buying a decryption program. The transaction has to be made via the Tor browser by paying 1 BTC (around 407 at that time), now Bitcoin accounts for roughly $5,260. Extortionists also claim that they will answer any of your questions if you are really motivated to pay a ransom. You can also decrypt 1 file via the Tor page linked in the note. As mentioned, third-parties tools are currently unable to decipher the locked data.

Whilst most ransomware developers focus on infecting Windows-based systems, AgeLocker targets Mac and Linux, instead. The ransomware positions itself as a business-oriented virus that spreads on corporative companies, however, attacks on regular users happen as well. The encryption process looks pretty similar to Windows, the only difference is using different extensions and file formats. AgeLocker applies its personal command prompt to run the encryption process. Files that have been impacted by AgeLocker get assigned with personalized extensions based on user's names. It is impossible to identify which file was infected because of AgeLocker ciphers the original name and adds a random extension at the end. Some people reported that their files were added with the .sthd2 extension and the name of encrypted files starts with the age-encryption.org URL-address. Once all files get locked successfully, the virus sends a ransom note (security_audit_.eml) to the victim's e-mail.

AESMewLocker Ransomware is a real menace that targets your data by encrypting it with AES File Format algorithms. It is nothing peculiar to the ransomware world. The virus popped up on multiple forums a couple of days ago and raised a big question around its victims - how to decrypt files? For now, there are no viable ways to unlock files that are getting encrypted with the .locked extension after penetration. All of your files become inaccessible and can be unlocked, only if you meet the swindler's requirements and pay for the decryption key. The key itself is not cheap, you have to spend 0.05 BTC and contact extortionists to get decryption instructions. All of this information is stated in a ransom note (READ_IT.txt) created after successful encryption.

IOCP is a ransomware infection that encrypts personal data and keeps it locked until victims pay a so-called ransom. It uses the random 5-letter extension to replace the original file appearance. Once it gets added, your file will reset its icon and change it to 1.mp4.UAKXC, for example. Some people get wrong saying that IOCP is part of Conti Ransomware. This not true because Conti uses AES algorithms whilst IOCP applies Salsa20 and ChaCha20, instead. After your files get blocked, the virus creates a ransom note (R3ADM3.txt) containing instructions on how to decrypt your data. It is said that you should write an e-mail to one of the attached addresses. No time boundaries are set, however, cybercriminals say that unless you pay for the decryption software, your files will be published around the web. For the moment, because this ransomware is relatively new, experts have not found a viable way to decrypt files for free.

Zorab is a file-encrypting virus determined by S!R1, malware researcher that opened a number of other infections. Consequences delivered by Zorab can be clearly seen in data encryption and payment demands to get decryption tools. All files impacted by ransomware will be reconfigured either with .zrb or .zorab2 extension. For example, a virus-free file like 1.mp4 will get a look of 1.mp4.zrb or 1.mp4.zorab2 after penetration. Such a change means that your files become no longer accessible. To decrypt them, extortionists offer to read instructions given in a text note (--DECRYPT--ZORAB.txt) that is dropped after major encryption gets done. In the ransom note, cybercriminals try to console confused victims and let them know that their data is safe and can be recovered. The only thing they have to do is buying decryption software in BTC after establishing contact with cybercriminals via e-mail. Also, there is a trick designed to incept trust in users - decryption of 2 small files for free. Unfortunately, since you are dealing with fraudulent means, there is no real guarantee that your files will be brought back as a result. This is why most cyber experts recommend people to save their money and create extraneous backups preemptively to restore blocked files after deletion of malware.

Discovered in 2020, CoronaLock restricts access to users' data by encrypting it with ChaCha, AES and RSA algorithms. Files compromised by this ransomware, experience a change in extension to either .pandemic, .corona-lock or .biglock. For example, if 1.mp4 gets modified by the virus, it will migrate to 1.mp4.corona-lock or 1.mp4.biglock. After this, extortionists display ransom information in the note (!!!READ_ME!!!.TXT or README_LOCK.TXT) that is dropped on the desktop. Interestingly enough, people who get attacked with ".biglock" extension, do not have any contact information in the ransom note to connect with cybercriminals. It seems like its developers forgot to include it before the release. In the meantime, ".corona-lock" versions do not have that drawback and contain e-mail in the text file. If you want to take a test-decryption, you are free to send them one file.