Eu Ransomware
Eu Ransomware is classified as a ransomware threat. It carries an encryption routine that locks the files of its victims. Any documents, images, photos, archives, databases, and many other file types may be rendered completely inaccessible as a result of the malware infection. In the vast majority of cases, ransomware attacks are carried out with the goal of extorting money from the impacted users or corporate entities. However, this appears to not apply to the Eu Ransomware threat.
For the most part, Eu Ransomware follows the common behavior of these types of threats. It encrypts the targeted files and modifies their names by appending '.eu' to them as a new extension. The malware will also change the current desktop background with a new image continuing instructions from the attackers. Another ransom note will be delivered as a text file named 'read_instruction.txt.'
When reading the messages left by Eu Ransomware it quickly becomes clear that the threat actors are pursuing different goals when spreading the threat. After all, the text file gives victims a detailed list of the necessary steps to recover their data by themselves. Apparently, Eu Ransomware carries its own decryptor tool and drops it to the infected devices. The attackers also leave an email address - 'dupex876@gmail.com,' if their victims need additional assistance in restoring their files.
The full text of the ransom note shown as a desktop background is:
Sorry, you can't unlock your all files
But why you download this virus?
Why bro, everyone who open this file can't get decryptor, so why you open this?
Read instruction, maybe you find decryptor 🙂
~ Union Europe
The text file contains the following message:
Don't worry, you can return all your files!
All your files like documents, photos, databases and other important are encrypted to .eu
If you want decrypt your all files for FREE follow the tutorial
• 1. Find my virus process name in TASKMANAGER and kill the process
• 2. Find in your windows registry ( LOCALMACHINE > OUTPUT > LOCALHOST > EUCRYPT ) if you cant find this just type in CMD /taskkill /F (kill my virus 🙂 )
• 3. Restart yours computer and find folder with 'my virus name, i mean not this name but my virus 🙂 ' and open this decryptor VIA admin and wait for DECRYPT all files , you can wait MAX 1 HOUR
But if you still dont like remove my virus manually contact me on this email - dupex876@gmail.com
~ EU
