Coharos Ransomware
Malware researchers have come across a new ransomware threat called Coharos Ransomware. When they studied it, they found out that the Coharos Ransomware belongs to the STOP Ransomware family.
Propagation and Encryption
Cybersecurity experts couldn’t pinpoint the exact propagation methods that the authors of the Coharos Ransomware have implemented. Some believe that mass spam email campaigns, pirated bogus copies of legitimate applications, and fake software updates may be some of the infection vectors involved in the spreading of the Coharos Ransomware. Once this ransomware threat infects your PC, it will scan it to locate all the files, which will be marked for encryption quickly. Then, the Coharos Ransomware will begin locking all the targeted files. When the Coharos Ransomware encrypts a file, it will alter its filename by adding a ‘.coharos’ extension. This means that a file, which was called ‘combat-boots.jpeg’ originally, will be renamed to ‘combat-boots.jpeg.coharos’ and you will no longer be able to open it.
The Ransom Note
When this is completed, the Coharos Ransomware drops a ransom note. The note is named ‘_readme.txt’ and states:
'ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-o7ClqIH7RS
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
gorentos@bitmessage.ch
Reserve e-mail address to contact us:
gorentos2@firemail.cc
Our Telegram account:
@datarestore
Mark Data Restore
Your personal ID:'
The creators of the Coharos Ransomware demand $890 as a ransom fee but claim to drop the price to $490 if the victim contacts them within 72 hours of the attack takes place. They also state that tare willing to unlock one file for free. There are two email addresses given out – ‘gorentos@bitmessage.ch’ and ‘gorentos2@firemail.cc.’ They also provide their Telegram contact details @datarestore.
We would advise you to keep your distance from cyber criminals like the ones who created the Coharos Ransomware. They deliver on their promises rarely but will gladly take your hard-earned cash. Instead, you should look into obtaining a reputable anti-virus software suite, which will remove the Coharos Ransomware from your PC safely.
