DumbStackz Ransomware Encrypts Most File Types

Our research team uncovered DumbStackz while going over new malicious file samples. This malicious software, derived from the Chaos ransomware, is engineered to encrypt files and demand payment for decryption.

Upon testing on our system, this ransomware successfully encrypted files and appended a ".DumbStackz" extension to their filenames. For instance, "1.jpg" became "1.jpg.DumbStackz", "2.png" became "2.png.DumbStackz", and so forth for all encrypted files.

Following encryption, DumbStackz altered the desktop wallpaper and generated a ransom note in a text file named "read_it.txt". The message from DumbStackz informs the victim of the file encryption and demands a ransom payment of 0.001 BTC (Bitcoin cryptocurrency). As of the time of writing, this equates to approximately 60 USD, bearing in mind that conversion rates are subject to change.

The ransom note assures the victim that upon payment, decryption tools will be provided. Failure to comply with these demands within a two-day period will result in the deletion of the affected files.

DumbStackz Ransom Note Threatens Data Loss

The full text of the DumbStackz ransom note reads as follows:

Sht well your files are locked. Lmao, well, sorry to say you won't be able to get them back without paying a fee. Unless you don't care about your files, I would encourage you to pay. The fee will cost you 0.001 bitcoin. Making this sht affordable. Sorry to cause you stress. Now, if you want to make this quick and simple, let's cut to the chase.

Step 1: Buy the bitcoin. Unless you own bitcoin, you will obviously need to buy it. Well, where the f*ck do I buy bitcoin?? You may be asking yourself that question. Luckily, there are many places to buy bitcoin. Such as apps like Coinbase, Crypto.com, Changelly Kraken, etc. There are also crypto ATMs to find one near you, go to coinflip.tech and enter a zip code. Or find others.

Step 2: Create a Bitcoin wallet. If you are on a mobile device, I recommend downloading Cake Wallet or Trust Wallet. They are wallets that hold many different crypto currencies. Such as Bitcoin. And if you are using a Windows computer, you can use the Wassabi wallet. It is a great and fast wallet to set up. From there, you can send the address you are sending the 0.001 bitcoin to, which is below this line. Or scan the QR code that is shown in my wallpaper. (My Bitcoin Address): 17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV

Step 3. Once you have sent the bitcoin successfully and it confirms through the blockchain, don't hesitate to contact me. I will provide you with the password to recover all of your files. It is another piece of software, so please disable virus and threat protection to allow it to decrypt successfully. Contact Me Once Paid: whosdumb_stackz@proton.me (This is an email, so you will need to write to me by email.)

Your files will be automatically deleted after 2 days from when this ransomware was installed. Do not try after 2 days because you will just be losing your money for nothing. Attempting to reset the computer will also delete all of your files, which you can try if you want.

PAY EXACTLY 0.001 BITCOIN OR YOUR FILES WILL NOT BE RELEASED TO YOU. IF ONE OF MY WORKERS IS THE ONE WHO GAVE YOU THIS RANSOMWARE, THEY WILL WAIT FOR THE PAYMENT TO GO THROUGH, AND THEY WILL GIVE YOU THE DECRYPTER. DO NOT TRY NEGOTIATING, OR ME OR MY WORKERS WILL BLOCK YOU. THE AMOUNT WILL NEED TO BE 0.001 BITCOIN, EVEN WITH THE FEES. MAKE SURE TO GET SOME EXTRA BITCOIN FOR EASY PAYMENT.

Again, if you have any issues or concerns, please contact me at whosdumb_stackz@proton.me (This is an email, so you will need to write to me by email.)

Bitcoin Address Again: 17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV

How is Ransomware Like DumbStackz Usually Propagated Online?

Ransomware like DumbStackz typically spreads through various online vectors, including:

Phishing Emails: Attackers often use phishing emails to distribute ransomware. These emails may contain malicious attachments or links that, when clicked, download and execute the ransomware onto the victim's system.

Malicious Websites: Visiting compromised or malicious websites can lead to drive-by downloads, where ransomware is automatically downloaded and installed onto the victim's device without their knowledge or consent.

Exploit Kits: Ransomware can be distributed through exploit kits, which are toolkits that exploit vulnerabilities in software to deliver malware onto a victim's system. These vulnerabilities may exist in outdated software or browsers.

Remote Desktop Protocol (RDP) Attacks: Attackers may exploit weak or default credentials for Remote Desktop Protocol (RDP) to gain unauthorized access to a system and deploy ransomware.

Malvertising: Malicious advertisements (malvertising) on legitimate websites can redirect users to websites hosting ransomware or initiate automatic downloads of ransomware onto the victim's device.

File-Sharing Networks: Ransomware can be spread through file-sharing networks and peer-to-peer (P2P) file-sharing applications, where users unknowingly download infected files.

Social Engineering Tactics: Attackers may use social engineering tactics to trick users into downloading and executing ransomware, such as posing as legitimate software updates or technical support personnel.