Cash Ransomware

En l'era digital, no es pot exagerar la importància de protegir els vostres dispositius i dades. Les amenaces cibernètiques, especialment el programari ransomware, s'han tornat cada cop més sofisticades, i representen seriosos riscos per a les persones i les organitzacions. Una d'aquestes amenaces emergents és el Cash Ransomware, un programari amenaçador dissenyat per xifrar fitxers dels dispositius infectats i exigir el pagament pel seu llançament. Comprendre aquesta amenaça i implementar pràctiques de seguretat sòlides són essencials per protegir els vostres actius digitals.

Què és el Cash Ransomware?

El Cash Ransomware és un tipus específic de programari maliciós conegut per xifrar dades en dispositius compromesos i demanar un rescat per desxifrar-los. Aquest ransomware s'atribueix als mateixos actors d'amenaça darrere del Cash RAT (troià d'accés remot) i MintStealer, cosa que indica un grup cibercriminal persistent i ben organitzat.

Com funciona el ransomware Cash

Un cop activat en un dispositiu compromès, el Cash Ransomware xifra els fitxers i afegeix una extensió ".CashRansomware" a cada fitxer afectat. Per exemple, "1.doc" passa a ser "1.doc.CashRansomware" i "2.pdf" passa a anomenar-se "2.pdf.CashRansomware". Després del procés de xifratge, el ransomware crea tres notes de rescat diferents: un nou fons de pantalla d'escriptori, una finestra emergent i un fitxer HTML anomenat "Cash Ransomware.html".

Exigències i advertències de rescat

Les notes de rescat, encara que no són idèntiques, transmeten la mateixa informació crítica:

• Notificació de xifratge de fitxers.
• Una demanda de rescat de 80 USD en criptomoneda Monero (XMR).
• Les advertències contra reiniciar el dispositiu o executar programes anti-malware podrien fer que els fitxers no es puguin xifrar.
• Instruccions per evitar la desconnexió de la xarxa per garantir la negociació i la recuperació.

Les notes també especifiquen que els fitxers es van xifrar mitjançant algorismes criptogràfics avançats: XChaCha20, Poly1305 i AES-256-GCM. Tanmateix, els experts en ciberseguretat adverteixen que pagar el rescat no garanteix la recuperació de dades, ja que els ciberdelinqüents sovint no proporcionen la clau de desxifrat fins i tot després del pagament.

Millors pràctiques de seguretat per prevenir atacs de ransomware

La prevenció del ransomware, inclòs el Cash Ransomware, requereix un enfocament proactiu de la ciberseguretat. Aquestes són algunes de les millors pràctiques que els usuaris haurien d'implementar per millorar la seva defensa contra el ransomware i altres amenaces de programari maliciós:

L'augment de les amenaces de ransomware com el Cash Ransomware posa de manifest la necessitat crítica de vigilància i mesures sòlides de ciberseguretat. En comprendre la naturalesa d'aquestes amenaces i implementar les millors pràctiques de seguretat, els usuaris poden reduir significativament les oportunitats de ser víctimes d'atacs de ransomware. Recordeu que sempre és millor prevenir que curar, i un enfocament proactiu de la ciberseguretat és la vostra millor defensa contra les amenaces digitals.

La nota de rescat que es presenta en una finestra emergent:

'Cash RANSOMWARE

YOUR FILES
ARE ENCRYPTED
BY CASH RANSOMWARE

What happend?

Dear , We regret to inform you that your files have been compromised by the insidious Cash Ransomware program. This ruthless malware has infiltrated your system, encrypting your precious data and holding it hostage until its demands are met. Below are the chilling details of this dire situation:

Rapid scanning of your storage drives has been executed, leaving no corner untouched by the malicious claws of Cash Ransomware.
Utilizing the advanced XChaCha20 encryption algorithm, your files have been ensnared with unbreakable tags and a deadly combination of Poly1305 or AES-256-GCM, meticulously chosen by the ransomware's constructors to ensure maximum devastation.
To further fortify its grip on your data, Cash Ransomware employs a hybrid bulletproof encryption technique, rendering any attempts at decryption futile against its impenetrable defenses.
Files bearing specific extensions have been singled out for priority encryption, ensuring that your most critical data is held captive, intensifying the fear and desperation of your predicament.
As a final blow to any hopes of recovery, Cash Ransomware deploys a double-key encryption mechanism, thwarting any attempts at deception or circumvention, leaving you no recourse but to comply with its demands.
In light of this harrowing situation, we implore you to refrain from taking any actions that may exacerbate the damage and worsen your plight:

Do not download antivirus software: Any attempts to combat Cash Ransomware with conventional means will only serve to alert its creators, potentially triggering further encryption or irreversible data loss.
Do not disconnect from the network: Isolation will not shield you from the relentless reach of Cash Ransomware; instead, it may hinder potential avenues of negotiation or resolution.
Do not reboot your systems: Restarting your devices could disrupt ongoing encryption processes, rendering your files irretrievable and sealing your fate in the clutches of this merciless malware.
We understand the gravity of your situation and stand ready to assist you in navigating this crisis. However, time is of the essence, and decisive action is imperative to mitigate the extent of the damage inflicted by Cash Ransomware.

How to decrypt my files?

Your files are heavily encrypted, and none can be decrypted without the decryption key.
To obtain the decryption key, you need to make a payment to the specified amount to the XMR / Monero wallet.
Once you've made the payment, you should contact the attackers via email or Telegram to receive the decryption key.
After receiving the decryption key, you need to input it into the decryption panel in Cash.
Once you hit the decryption button, your files will be decrypted.'

Nota de rescat lliurada com a fitxer HTML:

'ATTENTION!'ATTENTION!

YOUR FILES ARE ENCRYPTED BY Cash RANSOMWARE

Dear user, We regret to inform you that your files have been compromised by the insidious XChaCha20 encryption algorithm, your files have been ensnared with unbreakable tags and a deadly combination of Poly1305 or AES-256-GCM, meticulously chosen by the ransomware's constructors to ensure maximum devastation.
To further fortify its grip on your data, Cash Ransomware employs a hybrid bulletproof encryption technique, rendering any attempts at decryption futile against its impenetrable defenses.
Files bearing specific extensions have been singled out for priority encryption, ensuring that your most critical data is held captive, intensifying the fear and desperation of your predicament.
As a final blow to any hopes of recovery, Cash Ransomware deploys a double-key encryption mechanism, thwarting any attempts at deception or circumvention, leaving you no recourse but to comply with its demands.
In light of this harrowing situation, we implore you to refrain from taking any actions that may exacerbate the damage and worsen your plight:

Do not download antivirus software: Any attempts to combat Cash Ransomware with conventional means will only serve to alert its creators, potentially triggering further encryption or irreversible data loss.
Do not disconnect from the network: Isolation will not shield you from the relentless reach of Cash Ransomware; instead, it may hinder potential avenues of negotiation or resolution.
Do not reboot your systems: Restarting your devices could disrupt ongoing encryption processes, rendering your files irretrievable and sealing your fate in the clutches of this merciless malware.

We understand the gravity of your situation and stand ready to assist you in navigating this crisis. However, time is of the essence, and decisive action is imperative to mitigate the extent of the damage inflicted by Cash Ransomware.

85kCbkZzeaeiSx8h47yFjwUJ8u41FqgbpFbqGp5C93Rpa9eU 7pcYdp5Y7LNSrHkEVmTYa4oCuLeNnHGxVBLH78Uo2XEkXpZ
Copy Monero

dolores@bpe.cash
Copy Email

80$
Copy Amount'

Missatge mostrat a les víctimes com a imatge de fons d'escriptori:

'CASH RANSOMWARE'All computer got infected by Cash Ransomware.
All your personal files are encrypted
Using an unique and advanced encryption algorithm.'All computer got infected by Cash Ransomware.
All your personal files are encrypted
Using an unique and advanced encryption algorithm.

If you need your computer or your files
Please kindly follow steps on the software.
You can contact people that infected that
Computer by sending an email
Please check the Ransomware to get the email.

Avoid to install an anti-virus, installing a anti-virus
Will delete the Ransomware without decrypting files.
Please note that we won't be able to help you
If you're trying to bypass our system.

CASHRANSOMWARE'