'decryptFox@protonmail.com' Ransomware
PC security researchers first observed the decryptFox@protonmail.com' Ransomware, an encryption ransomware Trojan, on October 8, 2018. The decryptFox@protonmail.com' Ransomware is a typical encryption ransomware Trojan, which is often delivered to the victims through a variety of means commonly used to distribute these threats, including corrupted spam email attachments, bogus software downloads or unsafe online advertising. Threats like the decryptFox@protonmail.com' Ransomware are becoming more common increasingly, and it is paramount that PC users take steps to ensure that their data is protected from the decryptFox@protonmail.com' Ransomware and similar attacks. The main purpose of threats like the decryptFox@protonmail.com' Ransomware is to make the victim's files inaccessible, taking them hostage to demand a ransom payment from the intended target in exchange for the decryption key.
How the decryptFox@protonmail.com' Ransomware Attack Works
The decryptFox@protonmail.com' Ransomware is designed to take over the victim's computer, encrypting the victim's files to block access to them permanently. Threats like the decryptFox@protonmail.com' Ransomware target the data specified below in these attacks:
.jpg, .jpeg, .raw, .tif, .gif, .png, .bmp, .3dm, .max, .accdb, .db, .dbf, .mdb, .pdb, .sql, .dwg, .dxf, .cpp, .cs, .h, .php, .asp, .rb, .java, .jar, .class, .py, .js, .aaf, .aep, .aepx, .plb, .prel, .prproj, .aet, .ppj, .psd, .indd, .indl, .indt, .indb, .inx, .idml, .pmd, .xqx, .xqx, .ai, .eps, .ps, .svg, .swf, .fla, .as3, .as, .txt, .doc, .dot, .docx, .docm, .dotx, .dotm, .docb, .rtf, .wpd, .wps, .msg, .pdf, .xls, .xlt, .xlm, .xlsx, .xlsm, .xltx, .xltm, .xlsb, .xla, .xlam, .xll, .xlw, .ppt, .pot, .pps, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .sldx, .sldm, .wav, .mp3, .aif, .iff, .m3u, .m4u, .mid, .mpa, .wma, .ra, .avi, .mov, .mp4, .3gp, .mpeg, .3g2, .asf, .asx, .flv, .mpg, .wmv, .vob, .m3u8, .dat, .csv, .efx, .sdf, .vcf, .xml, .ses, .qbw, .qbb, .qbm, .qbi, .qbr , .cnt, .des, .v30, .qbo, .ini, .lgb, .qwc, .qbp, .aif, .qba, .tlg, .qbx, .qby , .1pa, .qpd, .txt, .set, .iif, .nd, .rtp, .tlg, .wav, .qsm, .qss, .qst, .fx0, .fx1, .mx0, .fpx, .fxr, .fim, .ptb, .ai, .pfb, .cgn, .vsd, .cdr, .cmx, .cpt, .csl, .cur, .des, .dsf, .ds4, .drw, .eps, .ps, .prn, .gif, .pcd, .pct, .pcx, .plt, .rif, .svg, .swf, .tga, .tiff, .psp, .ttf, .wpd, .wpg, .wi, .raw, .wmf, .txt, .cal, .cpx, .shw, .clk, .cdx, .cdt, .fpx, .fmv, .img, .gem, .xcf, .pic, .mac, .met, .pp4, .pp5, .ppf, .nap, .pat, .ps, .prn, .sct, .vsd, .wk3, .wk4, .xpm, .zip, .rar.
The decryptFox@protonmail.com' Ransomware marks the file it has as a target by adding the file extension '.encr' to the file's name. The decryptFox@protonmail.com' Ransomware also renames the affected file by replacing its name with alphanumerical characters. The decryptFox@protonmail.com' Ransomware delivers a ransom note in the form of a text file named 'readmy.txt,' which reads as follows:
'Attention! All your files are encrypted!
To recover your files and access them,
send a message with your id to email DecryptFox@protonmail.com
Please note when installing or running antivirus will be deleted
important file to decrypt your files and data will be lost forever!!!!
You have 5 attempts to enter the code. If you exceed this
the number, all the data, will be irreversibly corrupted. Be
careful when entering the code!
your id [32 chars long hex string]'
Dealing with the decryptFox@protonmail.com' Ransomware
The criminals responsible for the decryptFox@protonmail.com' Ransomware shouldn't be contacted, and the victims shouldn't agree into paying any ransom associated with the decryptFox@protonmail.com' Ransomware. Doing this allows these criminals to continue developing new threats and claiming new victims. Instead, PC users should take steps to ensure that their data is safe from threats like the decryptFox@protonmail.com' Ransomware by having file backups. Apart from file backups, PC security researchers also advise computer users to use a strong security program that is fully u-to-date to protect their devices fully.
