Threat Database Ransomware Dodoc Ransomware

Dodoc Ransomware

By CagedTech in Ransomware

Like most ransomware authors nowadays, the creators of the newly spotted Dodoc Ransomware have taken the easy route in building a data-locking Trojan and have relied on the code of an already existing threat – the STOP Ransomware. Thus, the Dodoc Ransomware belongs to the family of the STOP Ransomware and is fairly similar to the original.

Propagation and Encryption

It is not yet clear what methods of propagation have the authors of the Dodoc Ransomware employed in the spreading of their creation. Some speculate that the cyber crooks may be using bogus software updates, pirated fake variants of legitimate applications, and spam emails which contain corrupted attachments as these are among the most common techniques of propagating this type of malware. Once the Dodoc Ransomware compromises your system, it will swiftly scan it so it can locate the files which it was programmed to target. Next, the Dodoc Ransomware will start locking the targeted data using an encryption algorithm. Each file that undergoes the encryption process of the Dodoc Ransomware will have its name altered. This file-encrypting Trojan adds a '.dodoc' extension at the end of the names of the newly locked files. For example, if before the attack you had an audio file named 'song-bird.mp3' after the attack the file’s name will be changed to 'song-bird.mp3.dodoc.'

Ransom Note

The next phase of the attack is the dropping of the ransom note. The Dodoc Ransomware's ransom note is called '_readme.txt' and reads:


Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:

Reserve e-mail address to contact us:

Our Telegram account:
Mark Data Restore

Your personal ID:

The ransom fee mentioned is $980, but the user is offered a 50% discount, knocking the price down to $490, if they pay up within 72 hours. The user can have one file unlocked for free as long as it does not contain valuable information. This is usually done so that the attackers can prove to the user that they have a decryption key which can successfully recover their data. They offer two email addresses for contact – '' and '' They also give out their Telegram contact details - @datarestore.

We recommend you to stay away from shady individuals like the ones operating the Dodoc Ransomware. A much safer approach is to remove the Dodoc Ransomware from your system using a legitimate anti-malware application and then try to restore some of the data via a third-party data-recovery solution.

Related Posts


Most Viewed