DDOS Ransomware

The DDOS Ransomware is a recently uncovered file-encryption Trojan. Upon further inspection, it was discovered that the DDOS Ransomware is a variant of the very widely-known Dharma (also called Crysis) Ransomware.

It is not confirmed what propagation method the authors of the DDOS Ransomware are employing, but it is believed that they may rely on fraudulent updates, pirated content, and emails containing an infected attachment to spread their data-locking Trojan. Once the DDOS Ransomware has sneaked into its victim's computer, it performs the first step of the attack – a scan. The DDOS Ransomware would scan your machine to locate all the files it was programmed to go after. When detected, the files would undergo the DDOS Ransomware's encryption process. After DDOS Ransomware locks the targeted files, it would add its own extension to them. The DDOS Ransomware does not stray from the path and applies the signature move extension pattern of almost all ransomware threats from the Dharma Ransomware family - '.id-.[decripted@cock.li].DDOS. As the extension suggests, the DDOS Ransomware generates a unique ID for each one of its victims. When this process is completed, the DDOS Ransomware moves on to dropping its ransom note. Often, the attackers would specify a sum that they would like to receive to provide the victim with a decryption tool. However, the creators of the DDOS Ransomware do not do that. Instead, they simply provide an email address where they are to be contacted – decripted@cock.li. It is likely that they would say what the ransom fee is if you contact them.

We would recommend you to stay away from the authors of the DDOS Ransomware, as well as any other cyber crook for that matter. Individuals who deal with that business are not to be trusted. Do not send your hard earned cash to these crooks. What you could do instead is download and install a reputable anti-malware application and use it to clean your system.