NUEVO RANSOMWARE “Ransom.Peekaboo”

Un nuevo ransomware que añade “Peekaboo” a los ficheros cifrados, pasa a ser controlado a partir del ELISTARA 41.60 de hoy

Al parecer solo cifra ficheros de datos “.DAT” y una vez terminada la exploración y cifrado, se autoelimina.

Crea fichero de información en

@@_HELPER_@@.txt

@@_READ_ME_@@.txt

@@_TAKE_A_LOOK_@@

con el siguiente texto:

————-

SORRY! Your files are encrypted.
File contents are encrypted with random key.
Random key is encrypted with RSA public key (2048 bit).
We STRONGLY RECOMMEND you NOT to use any “decryption tools”.
These tools can damage your data, making recover IMPOSSIBLE.
Also we recommend you not to contact data recovery companies.
They will just contact us, buy the key and sell it to you at a higher price.
If you want to decrypt your files, you have to get RSA private key.
—
In order to get private key, write here: perdrolan@cock.li
===========
!ATTENTION!
Attach file is 000000000.key from %appdata% to email message,
without it we will not be able to decrypt your files
===========
And pay $300 on BTC-wallet: 1NkjBNF7fmpRsX4WjokUie21m8bv9xvRKs
If someone else offers you files restoring, ask him for test decryption.
Only we can successfully decrypt your files; knowing this can protect you from fraud.
You will receive instructions of what to do next.
$$$$$$$$$$$$$$$$$$$$$$$$> PEEKABOO <$$$$$$$$$$$$$$$$$$$$$$$$

————

total ofrece el siguiente informe>

Lo pasamos a controlar a partir del ELISTARA 41.60 de hoy

saludos

ms, 2-7-2019