Block Ransomware

The Block Ransomware is a threatening malware that locks a wide variety of file types and renders them unusable completely. The goal of the attackers is to then extort their victims for money in exchange for providing them with the decryption key needed to restore the affected information. It appears that the Block Ransomware is mainly targeted at users located in Russian-speaking countries, judging by the fact that its ransom note is entirely in Russian.

One of the first symptoms that something is wrong is the sudden change of the normal names of the affected files. Indeed, the threat marks all files it encrypts by appending '.block' as a new file extension. Upon completing its encryption algorithm, the threat will generate a ransom note inside a text file named 'readMe!.txt.' The ransom-bearing file will be dropped on the desktop of the compromised system.

Ransom Note's Overview

As we said earlier, the Block Ransomware's note contents are written in Russian. Rough translation reveals that the attackers urge their victims to contact the 'yaga.babushka@yahoo.com' as soon as possible to receive additional instructions. The note also mentions that the email message must contain the unique ID string found inside the ransom note. Victims are warned that attempts to decrypt the files on their own could lead to permanent data loss.

The full text of the note is:

'Внимание! Ваши файлы зашифрованы. Обязательно отправьте на e-mail yaga.babushka@yahoo.com один из файлов для получения инструкций. Попытки самостоятельно расшифровать файлы приведут к их безвозвратной порче. ОБЯЗАТЕЛЬНО укажите ваш ID.'

The translation to English reads:

'Attention! Your files are encrypted. Be sure to email one of the files to yaga.babushka@yahoo.com for instructions. Attempts to decrypt files on your own will lead to their irrecoverable damage. You MUST provide your ID.'

Block Ransomware Video

Tip: Turn your sound ON and watch the video in Full Screen mode.