It says that the encryption method used is RSA, and the encryption and decryption keys are different. The note promises that after the email is sent, the requirements for the decryption process will be provided, along with the password itself and a sample virus into which the password must be entered. The ransom note says that all of the victim's files have been encrypted, and an email must be sent to with the text 'Расшифровки Имя паразора: n40vU5uS' and to regain access to files. Thus, victims who do not have this language installed on their computers see gibberish text. Screenshot of files encrypted by this ransomware:

DrWeb' extension to filenames, displays an error pop-up window and creates the ' КАК РАСШИФРОВАТЬ ФАЙЛЫ.txt' file (a ransom note).Īn example of how DrWeb modifies filenames: it changes ' 1.jpg' to ' 1.jpg.DrWeb', ' 2.png' to ' 2.png.DrWeb', and so forth. Our malware researchers discovered DrWeb during an analysis of malware samples submitted to the VirusTotal website. DrWeb is ransomware belonging to the Xorist family.

Cleaner recuva