Charm Ransomware
The Charm Ransomware is an encryption ransomware Trojan that was first reported in mid-October 2018. The Charm Ransomware is typically delivered to victims via corrupted email attachments, often in the form of DOCX files with embedded macro scripts that download and install the Charm Ransomware onto the victim's computer. Once the Charm Ransomware is installed, this threat is designed to take the victim's data hostage and demand a ransom payment for its return.
A Brief Analyze of the Charm Ransomware Trojan
The Charm Ransomware uses a strong encryption algorithm to make the victim's files inaccessible in its attack. The Charm Ransomware targets the user-generated files, which may include a wide variety of file types, such as media files, databases, and numerous documents. The Charm Ransomware marks each compromised file by adding the file extension '.charm' to the affected files' names. The Charm Ransomware targets numerous file types in its attacks, which include:
.jpg, .jpeg, .raw, .tif, .gif, .png, .bmp, .3dm, .max, .accdb, .db, .dbf, .mdb, .pdb, .sql, .dwg, .dxf, .cpp, .cs, .h, .php, .asp, .rb, .java, .jar, .class, .py, .js, .aaf, .aep, .aepx, .plb, .prel, .prproj, .aet, .ppj, .psd, .indd, .indl, .indt, .indb, .inx, .idml, .pmd, .xqx, .xqx, .ai, .eps, .ps, .svg, .swf, .fla, .as3, .as, .txt, .doc, .dot, .docx, .docm, .dotx, .dotm, .docb, .rtf, .wpd, .wps, .msg, .pdf, .xls, .xlt, .xlm, .xlsx, .xlsm, .xltx, .xltm, .xlsb, .xla, .xlam, .xll, .xlw, .ppt, .pot, .pps, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .sldx, .sldm, .wav, .mp3, .aif, .iff, .m3u, .m4u, .mid, .mpa, .wma, .ra, .avi, .mov, .mp4, .3gp, .mpeg, .3g2, .asf, .asx, .flv, .mpg, .wmv, .vob, .m3u8, .dat, .csv, .efx, .sdf, .vcf, .xml, .ses, .qbw, .qbb, .qbm, .qbi, .qbr , .cnt, .des, .v30, .qbo, .ini, .lgb, .qwc, .qbp, .aif, .qba, .tlg, .qbx, .qby , .1pa, .qpd, .txt, .set, .iif, .nd, .rtp, .tlg, .wav, .qsm, .qss, .qst, .fx0, .fx1, .mx0, .fpx, .fxr, .fim, .ptb, .ai, .pfb, .cgn, .vsd, .cdr, .cmx, .cpt, .csl, .cur, .des, .dsf, .ds4, .drw, .eps, .ps, .prn, .gif, .pcd, .pct, .pcx, .plt, .rif, .svg, .swf, .tga, .tiff, .psp, .ttf, .wpd, .wpg, .wi, .raw, .wmf, .txt, .cal, .cpx, .shw, .clk, .cdx, .cdt, .fpx, .fmv, .img, .gem, .xcf, .pic, .mac, .met, .pp4, .pp5, .ppf, .nap, .pat, .ps, .prn, .sct, .vsd, .wk3, .wk4, .xpm, .zip, .rar.
The Charm Ransomware delivers a ransom note in the form of a text file named 'HOW_TO_RETURN_FILES.txt,' which demands that the victim contact the criminals via email. The Charm Ransomware ransom note contains the following text:
'Dear manager,
your database server has been locked, your databases files are encrypted and you have unfortunately "lost" all your data, Encryption was produced using unique key AES-256 generated for this server.
To decrypt files you need to obtain the decryption key and tool.
All encrypted files ends with .charm
To obtain the program for this server, which will decrypt all files, you need to write me to email: "fmhir@protonmail.com"
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it - it's your guarantee that we have decryption tool. And send us your userkey
We don't know who are you, All what we need is some money.
Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again.
You can use one of that bitcoin exchangers for transfering bitcoin:
h[tt]ps://localbitcoins[.]com
h[tt]ps://www.kraken[.]com
You dont need install bitcoin programs - you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country.
Please use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language.
You don't have enough time to think each day payment will increase and after one week your key will be deleted and your files will be locked forever.
USERKEY:[random characters]'
Protecting Your Data from Threats Like the Charm Ransomware
The best protection against threats like the Charm Ransomware is to have backup copies of your files. The right security program may intercept the Charm Ransomware before it carries out its attack. However, the encrypted files cannot be restored without the decryption key, which the criminals hold in their possession.
