RESTORE_INFO-xxxx , 10 letter extra extension, 0x86, Plugins and new Ransomware

A new Variant of Ransomware has been reported by some of our clients.

All data files (php, htm, txt, zip) are encrypted and have been renamed by adding a 10-letter file extension that looks random – like this:

snips.txt.wxdrJbgSDa

Web.config.nUZPveYgIp

The ransom note left in every folder reads like this:

————————————————————————-

On closer malware analysis

The cost of the decoder is $ 2100 as demanded by criminals.

If you have been infected with such ransomware contact our technical team for further help.