'Blacknord@tutanota.com' Ransomware

The 'Blacknord@tutanota.com' Ransomware is an encryption ransomware Trojan that was first observed on January 25, 2018. The 'Blacknord@tutanota.com' Ransomware is a variant of another ransomware Trojan that had already been observed, and is known as the RotoCrypt or RotorCrypt Ransomware. The 'Blacknord@tutanota.com' Ransomware may be delivered to victims through the use of corrupted spam email messages and ake messages sent through social media platforms and instant messaging. The 'Blacknord@tutanota.com' Ransomware's delivery method relies on convincing the victim to download and install a PDF or DOCX file with embedded macros that download and install the 'Blacknord@tutanota.com' Ransomware onto the victim's computer. Once the 'Blacknord@tutanota.com' Ransomware has been installed on the victim's computer, the tactic it uses is fairly typical of these threats, and the 'Blacknord@tutanota.com' Ransomware will corrupt the victim's files. Then the victim needs to pay a ransom to get the decryption key needed to restore the affected files to normal. The 'Blacknord@tutanota.com' Ransomware is designed to take the victims' files hostage in exchange for a ransom payment.

The 'Blacknord@tutanota.com' Ransomware Attack

After the 'Blacknord@tutanota.com' Ransomware installation, it connects to its Command and Control server and downloads instructions, also relaying information about the infected computer. The 'Blacknord@tutanota.com' Ransomware will scan the infected computer in search for the user-generated files. The 'Blacknord@tutanota.com' Ransomware will target various file types in its attack, typically looking for images, music, videos and office documents. The file types that are usually targeted in ransomware attacks like the 'Blacknord@tutanota.com' Ransomware include:

.3dm, .3g2, .3gp, .7zip, .aaf, .accdb, .aep, .aepx, .aet, .ai, .aif, .as, .as3, .asf, .asp, .asx, .avi, .bmp, .c, .class, .cpp, .cs, .csv, .dat, .db, .dbf, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .efx, .eps, .fla, .flv, .gif, .h, .idml, .iff, .indb, .indd, .indl, .indt, .inx, .jar, .java, .jpeg, .jpg, .js, .m3u, .m3u8, .m4u, .max, .mdb, .mid, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .pdb, .pdf, .php, .plb, .pmd, .png, .pot, .potm, .potx, .ppam, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .ps, .psd, .py, .ra, .rar, .raw, .rb, .rtf, .sdf, .sdf, .ses, .sldm, .sldx, .sql, .svg, .swf, .tif, .txt, .vcf, .vob, .wav, .wma, .wmv, .wpd, .wps, .xla, .xlam, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xqx, .xqx, .zip.

The 'Blacknord@tutanota.com' Ransomware uses a strong encryption method, which may include the AES and RSA encryptions. Once the 'Blacknord@tutanota.com' Ransomware has compromised the files with its attack, they will no longer be readable. The 'Blacknord@tutanota.com' Ransomware will mark the files compromised by the attack renaming them. The 'Blacknord@tutanota.com' Ransomware ads the following string to each affected files' name, prompting the victims of the 'Blacknord@tutanota.com' Ransomware attack to contact the crooks at the email address included in this string:

!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve

How the 'Blacknord@tutanota.com' Ransomware's Makers may Profit from this Attack

After the 'Blacknord@tutanota.com' Ransomware encrypts the victim's files with its attack, the 'Blacknord@tutanota.com' Ransomware will demand a ransom payment. Threats like the 'Blacknord@tutanota.com' Ransomware will drop a ransom note on the infected computer's desktop, often in the form of a TXT file. This ransom note will claim that the victim can 'purchase a decryptor' by communicating with the crooks via email. The cost of recovering from these attacks for individual computer users is typically close to 1000 USD, paid using Bitcoin or other cryptocurrencies. Computer users are counseled not to pay these ransoms or communicate with the crooks. It is not probable that the crooks will keep their word and help victims recover their files after the 'Blacknord@tutanota.com' Ransomware attack. Furthermore, victims that communicate with these people may expose themselves to further infections and other tactics. Instead of contacting the crooks, they should take preemptive measures to ensure that their data is safe from these attacks, such as having file backups and using a strong security program.