However, in some cases, free tools available on the internet can be used to decrypt files. Usually, victims are compelled to pay a ransom to threat actors as decryption tools provided by them are the only means to decrypt encrypted files. The "_readme.txt" file lists two email addresses for contacting the and More about ransomware The note asserts that it is impossible to restore encrypted files without these tools.Īdditionally, the note indicates that victims can send a single encrypted file to the attackers for free decryption. The ransom note from Cosw includes payment and contact details and urges victims to reach out to the attackers within 72 hours to pay $490 for the decryption tools instead of $980. Screenshot of files encrypted by Cosw ransomware: As an example of how Cosw renames files: it changes " 1.jpg" to " 1.jpg.cosw" " 2.png" to " 2.png.cosw" and so on. It is worth noting that Cosw may be distributed alongside information stealers such as RedLine or Vidar. Cosw also creates a file named " _readme.txt", which contains instructions on how to pay a ransom to obtain a decryption tool.
Its primary aim is to encrypt files on the infected computer and rename them with by appending the ". Our investigation of malware samples uploaded to VirusTotal has uncovered a new version of the Djvu ransomware dubbed Cosw.
0 kommentar(er)
