ChupaCabra Ransomware

ChupaCabra is a threat classified as ransomware. This means that its main goal is to infect the targeted computers, run an encryption routine on them, and then extort its victims for money. The threat is capable of locking a large array of file types, including all of the most popular ones - PDFs, documents, photos, images, archives, databases, audio and video files, etc. Afterward, users will no longer be able to access the affected data, potentially losing vital personal or work-related files. 

Each encrypted file will be marked by having '.ChupaCabra' attached to its original name as a new extension. As for its ransom note, the threat generates a pop-up window and creates a text file named 'HowToDecrypt.txt.' The messages in both places are identical. 

ChupaCabra's Demands

The note left by ChupaCabra Ransomware is extremely brief. It, however, contains the most important aspects usually found in these messages. Apparently, the hackers want to receive the sum of 0.00364383 BTC. At the current exchange rate of the cryptocurrency, this specific amount is equal to approximately $140. After transferring the money to the crypto-wallet address also found inside the note, victims are directed towards establishing contact with the hackers. For this purpose, the operators of the threat leave only a Telegram account. 

Generally, it is not recommended to trust cybercriminals or follow their instructions. Doing so can lead to additional security risks or monetary loss, on top of the already locked data. The best course of action following a ransomware infection is to remove the threat from the system and then look for a suitable backup to restore the encrypted files. 

The text of the pop-up and text file delivered by ChupaCabra Ransomware is:

'IMPORTANT INFORMATION!!! All your files are encrypted with ChupaCabra:v.2.0 Reload To Decrypt: - Send 0.00364383 BTC to: 1Eh4f3p2fQVjfyHAyJ2rCqjUgDxPgjJE5q - Contact me Telegram: @C_h_u_p_a_K_a_b_r_a'