DumbStackz Ransomware krypterer de fleste filtyper
Vores forskerhold afslørede DumbStackz, mens vi gennemgik nye ondsindede fileksempler. Denne ondsindede software, der stammer fra Chaos ransomware, er udviklet til at kryptere filer og kræve betaling for dekryptering.
Efter at have testet på vores system, krypterede denne ransomware med succes filer og tilføjede en ".DumbStackz"-udvidelse til deres filnavne. For eksempel blev "1.jpg" til "1.jpg.DumbStackz", "2.png" blev til "2.png.DumbStackz" og så videre for alle krypterede filer.
Efter kryptering ændrede DumbStackz skrivebordsbaggrunden og genererede en løsesumseddel i en tekstfil med navnet "read_it.txt". Beskeden fra DumbStackz informerer offeret om filkrypteringen og kræver en løsesum på 0,001 BTC (Bitcoin cryptocurrency). I skrivende stund svarer dette til ca. 60 USD, med tanke på at konverteringsraterne kan ændres.
Løsesedlen forsikrer offeret om, at der ved betaling vil blive leveret dekrypteringsværktøjer. Manglende overholdelse af disse krav inden for en to-dages periode vil resultere i sletning af de berørte filer.
DumbStackz Ransom Note truer datatab
Den fulde tekst af DumbStackz løsesumseddel lyder som følger:
Sht well your files are locked. Lmao, well, sorry to say you won't be able to get them back without paying a fee. Unless you don't care about your files, I would encourage you to pay. The fee will cost you 0.001 bitcoin. Making this sht affordable. Sorry to cause you stress. Now, if you want to make this quick and simple, let's cut to the chase.
Step 1: Buy the bitcoin. Unless you own bitcoin, you will obviously need to buy it. Well, where the f*ck do I buy bitcoin?? You may be asking yourself that question. Luckily, there are many places to buy bitcoin. Such as apps like Coinbase, Crypto.com, Changelly Kraken, etc. There are also crypto ATMs to find one near you, go to coinflip.tech and enter a zip code. Or find others.
Step 2: Create a Bitcoin wallet. If you are on a mobile device, I recommend downloading Cake Wallet or Trust Wallet. They are wallets that hold many different crypto currencies. Such as Bitcoin. And if you are using a Windows computer, you can use the Wassabi wallet. It is a great and fast wallet to set up. From there, you can send the address you are sending the 0.001 bitcoin to, which is below this line. Or scan the QR code that is shown in my wallpaper. (My Bitcoin Address): 17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV
Step 3. Once you have sent the bitcoin successfully and it confirms through the blockchain, don't hesitate to contact me. I will provide you with the password to recover all of your files. It is another piece of software, so please disable virus and threat protection to allow it to decrypt successfully. Contact Me Once Paid: whosdumb_stackz@proton.me (This is an email, so you will need to write to me by email.)
Your files will be automatically deleted after 2 days from when this ransomware was installed. Do not try after 2 days because you will just be losing your money for nothing. Attempting to reset the computer will also delete all of your files, which you can try if you want.
PAY EXACTLY 0.001 BITCOIN OR YOUR FILES WILL NOT BE RELEASED TO YOU. IF ONE OF MY WORKERS IS THE ONE WHO GAVE YOU THIS RANSOMWARE, THEY WILL WAIT FOR THE PAYMENT TO GO THROUGH, AND THEY WILL GIVE YOU THE DECRYPTER. DO NOT TRY NEGOTIATING, OR ME OR MY WORKERS WILL BLOCK YOU. THE AMOUNT WILL NEED TO BE 0.001 BITCOIN, EVEN WITH THE FEES. MAKE SURE TO GET SOME EXTRA BITCOIN FOR EASY PAYMENT.
Again, if you have any issues or concerns, please contact me at whosdumb_stackz@proton.me (This is an email, so you will need to write to me by email.)
Bitcoin Address Again: 17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV
Hvordan spredes ransomware som DumbStackz normalt online?
Ransomware som DumbStackz spredes typisk gennem forskellige online vektorer, herunder:
Phishing-e-mails: Angribere bruger ofte phishing-e-mails til at distribuere ransomware. Disse e-mails kan indeholde ondsindede vedhæftede filer eller links, der, når de klikkes, downloader og udfører ransomwaren på offerets system.
Ondsindede websteder: Besøg af kompromitterede eller ondsindede websteder kan føre til drive-by-downloads, hvor ransomware automatisk downloades og installeres på ofrets enhed uden deres viden eller samtykke.
Udnyttelsessæt: Ransomware kan distribueres gennem udnyttelsessæt, som er værktøjssæt, der udnytter sårbarheder i software til at levere malware til et offers system. Disse sårbarheder kan eksistere i forældet software eller browsere.
Remote Desktop Protocol (RDP)-angreb: Angribere kan udnytte svage eller standardlegitimationsoplysninger til Remote Desktop Protocol (RDP) for at få uautoriseret adgang til et system og implementere ransomware.
Malvertising: Ondsindede reklamer (malvertising) på legitime websteder kan omdirigere brugere til websteder, der hoster ransomware eller starte automatiske downloads af ransomware på offerets enhed.
Fildelingsnetværk: Ransomware kan spredes gennem fildelingsnetværk og peer-to-peer (P2P) fildelingsapplikationer, hvor brugere ubevidst downloader inficerede filer.
Social Engineering Taktik: Angribere kan bruge social engineering taktik til at narre brugere til at downloade og udføre ransomware, såsom at udgive sig for legitime softwareopdateringer eller teknisk supportpersonale.
