File Spider Ransomware

The File Spider Ransomware is an encryption ransomware Trojan that is being distributed on the Dark Web. The File Spider Ransomware uses a combination of the AES and RSA encryptions to make victims' files unusable. The purpose of these attacks is to take the victim's files hostage and then demand payment from the computer user in exchange for the decryption key. The File Spider Ransomware will target the user-generated files while avoiding the Windows system files. The File Spider Ransomware encrypts an extraordinarily large number of file types compared to most encryption ransomware Trojans. While most of these threats will encrypt several dozen types of files, the File Spider Ransomware will encrypt more than one thousand file types in its attacks. The File Spider Ransomware is designed to attack computer users in south-eastern Europe.

Some Nuances of the File Spider Ransomware Attack

The File Spider Ransomware will encrypt the following file types:

.001, .036, .0411, .1cd, .1st, .2bp, .3dm, .3ds, .3fr, .3g2, .3gp, .3gp, .4db, .4dl, .4mp, .73i, .7z, .7zip, .8xi, .9png, .a3d, .aaf, .abm, .abs, .abw, .accdb, .accdc, .accde, .accdr, .accdt, .accdw, .accft, .act, .adn, .adp, .aep, .aepx, .aet, .af2, .af3, .aft, .afx, .agif, .agp, .ahd, .ai, .aic, .aif, .aim, .albm, .alf, .ani, .ans, .apd, .apk, .apm, .apng, .aps, .apt, .apx, .arch00, .art, .artwork, .arw, .as, .as3, .asc, .ascii, .ase, .asf, .ask, .asp, .asset, .asw, .asx, .asy, .aty, .avatar, .awdb, .awp, .awt, .aww, .azz, .backup, .bad, .bak, .bar, .bat, .bay, .bbs, .bc6, .bc7, .bdb, .bdp, .bdr, .bean, .bib, .big, .bik, .bkf, .bkp, .blend, .blkrt, .blob, .bm2, .bmp, .bmx, .bmz, .bna, .bnd, .boc, .bok, .brk, .brn, .brt, .bsa, .bss, .btd, .bti, .btr, .byu, .bzabw, .c, .c4, .c4d, .cal, .cals, .can, .cas, .cd5, .cdb, .cdc, .cdg, .cdmm, .cdmt, .cdmtz, .cdmz, .cdr, .cdr3, .cdr4, .cdr6, .cdrw, .cdt, .cer, .cf, .cfr, .cfu, .cgm, .chart, .chord, .cimg, .cin, .cit, .ckp, .class, .clkw, .cma, .cmx, .cnm, .cnv, .colz, .conf, .contact, .cpc, .cpd, .cpg, .cpp, .cps, .cpt, .cpx, .cr2, .crd, .crt, .crw, .crwl, .cs, .css, .csv, .csy, .ct, .cv5, .cvg, .cvi, .cvs, .cvx, .cwt, .cxf, .cyi, .d3dbsp, .daconnections, .dacpac, .dad, .dadiagrams, .daf, .das, .daschema, .dat, .DayZProfile, .dazip, .db, .db0, .db2, .db3, .dbc, .dbf, .dbfv, .dbk, .dbs, .db-shm, .dbt, .dbv, .db-wal, .dbx, .dc2, .dca, .dcb, .dcr, .dcs, .dct, .dcx, .ddl, .ddoc, .dds, .ded, .der, .desc, .design, .df1, .dgn, .dgs, .dgt, .dhs, .dib, .dicom, .diz, .djv, .djvu, .dm3, .dmi, .dmo, .dmp, .dnc, .dne, .dng, .doc, .docb, .docm, .docx, .docxml, .docz, .dot, .dotm, .dotx, .dp1, .dpp, .dpx, .dqy, .drw, .drz, .dsk, .dsn, .dsv, .dt, .dt2, .dta, .dtsx, .dtw, .dvi, .dvl, .dwg, .dx, .dxb, .dxf, .dxg, .dxl, .eco, .ecw, .ecx, .edb, .efd, .efx, .egc, .eio, .eip, .eit, .email, .emd, .emf, .emlx, .ep, .epf, .epk, .epp, .eps, .epsf, .eql, .erf, .err, .esm, .etf, .etx, .euc, .exr, .fadein, .fal, .faq, .fax, .fb2, .fb3, .fbl, .fbx, .fcd, .fcf, .fdb, .fdf, .fdr, .fds, .fdt, .fdx, .fdxt, .fes, .ff, .fft, .fh10, .fh11, .fh3, .fh4, .fh5, .fh6, .fh7, .fh8, .fic, .fid, .fif, .fig, .fil, .fla, .flc, .fli, .flr, .fm5, .fmp, .fmp12, .fmpsl, .fmv, .fodt, .fol, .forge, .fos, .fountain, .fp3, .fp4, .fp5, .fp7, .fpk, .fpos, .fpt, .fpx, .frt, .fsh, .ft10, .ft11, .ft7, .ft8, .ft9, .ftn, .fwdn, .fxc, .fxg, .fzb, .fzv, .g3, .gcdp, .gdb, .gdoc, .gdraw, .gem, .geo, .gfb, .gfie, .ggr, .gho, .gif, .gih, .gim, .gio, .glox, .gmbck, .gmspr, .gpd, .gpn, .gro, .grob, .grs, .gsd, .gthr, .gtp, .gv, .gwi, .h, .hbk, .hdb, .hdp, .hdr, .hht, .his, .hkdb, .hkx, .hpg, .hpgl, .hpi, .hpl, .hplg, .hs, .htc, .html, .hvpl, .hwp, .hz, .i3d, .ib, .ibank, .icn, .icon, .icpr, .icxs, .idc, .idea, .idml, .idx, .iff, .igt, .igx, .ihx, .iil, .iiq, .imd, .indb, .indd, .indl, .indt, .info, .ink, .int, .inx, .ipf, .ipx, .itc2, .itdb, .itl, .itm, .itw, .iwd, .iwi, .j, .j2c, .j2k, .jar, .jarvis, .jas, .java, .jb2, .jbig, .jbig2, .jbmp, .jbr, .jfif, .jia, .jis, .jng, .joe, .jp1, .jp2, .jpe, .jpeg, .jpg, .jpg2, .jps, .jpx, .jrtf, .js, .jtf, .jtx, .jwl, .jxr, .kdb, .kdbx, .kdc, .kdi, .kdk, .kes, .kf, .kic, .klg, .knt, .kon, .kpg, .kwd, .latex, .layout, .lbf, .lbm, .lbt, .lgc, .lis, .lit, .litemod, .ljp, .lmk, .lnk, .lnt, .lp2, .lrc, .lrf, .lst, .ltr, .ltx, .lue, .luf, .lvl, .lwo, .lwp, .lws, .lxfml, .lyt, .lyx, .m2, .m3d, .m3u, .m3u8, .m4a, .m4u, .ma, .mac, .man, .map, .maq, .mat, .max, .mb, .mbm, .mbox, .mcgame, .mcmeta, .md5txt, .mdb, .mdbackup, .mdbhtml, .mddata, .mdf, .mdn, .mdt, .me, .mef, .mell, .menu, .mft, .mgcb, .mgmf, .mgmt, .mgmx, .mgtx, .mid, .min, .mkv, .mlx, .mmat, .mng, .mnr, .mnt, .mobi, .mos, .movie, .mp4, .mpa, .mpf, .mpo, .mpqge, .mrg, .mrwref, .mrxs, .msg, .mt9, .mud, .mwb, .mwp, .mxl, .myd, .myl, .ncf, .ncr, .nct, .ndf, .nfo, .njx, .nlm, .notes, .now, .nrw, .ns2, .ns3, .ns4, .nsf, .ntl, .nv2, .nwctxt, .nyf, .nzb, .obj, .oc3, .oc4, .oc5, .oce, .oci, .ocr, .odb, .odc, .odm, .odo, .odp, .ods, .odt, .ofl, .oft, .omf, .openbsd, .oplc, .oqy, .ora, .orf, .ort, .orx, .ota, .otg, .oti, .ott, .ovp, .ovr, .owc, .owg, .oyx, .ozb, .ozj, .ozt, .p12, .p7b, .p7c, .p7s, .p96, .p97, .pages, .pak, .pal, .pan, .pano, .pap, .pbd, .pbl, .pbm, .pc1, .pc2, .pc3, .pcd, .pcs, .pcx, .pdb, .pdd, .pdf, .pdm, .pdn, .pe4, .pef, .pem, .pfd, .pff, .pfi, .pfs, .pfv, .pfx, .pgf, .pgm, .phm, .php, .pi1, .pi2, .pi3, .pic, .pict, .pix, .pjpeg, .pjpg, .pjt, .pkpass, .pl, .plantuml, .plb, .plt, .pm, .pmd, .pmg, .png, .pni, .pnm, .pntg, .pnz, .pobj, .pop, .pot, .potm, .potx, .pp4, .pp5, .ppam, .ppj, .ppm, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .prt, .prw, .ps, .ps1, .psd, .psdx, .pse, .psid, .psk, .psp, .pspbrush, .pst, .psw, .ptg, .pth, .ptx, .pu, .pvj, .pvm, .pvr, .pwa, .pwi, .pwr, .px, .pxr, .py, .pz3, .pza, .pzp, .pzs, .qdf, .qdl, .qic, .qmg, .qpx, .qry, .qvd, .r3d, .ra, .rad, .raf, .rar, .ras, .raw, .rb, .rctd, .rcu, .rdb, .rdl, .re4, .readme, .rft, .rgb, .rgf, .rgss3a, .rib, .ric, .riff, .rim, .ris, .rix, .rle, .rli, .rng, .rofl, .rpd, .rpf, .rpt, .rri, .rs, .rsb, .rsd, .rsr, .rst, .rt, .rtd, .rtf, .rtx, .run, .rw2, .rwl, .rzk, .rzn, .s2mv, .s3m, .saf, .safetext, .sai, .sam, .sav, .save, .sb, .sbf, .sc2save, .scad, .scc, .sci, .scm, .scriv, .scrivx, .sct, .scv, .scw, .sdb, .sdf, .sdm, .sdoc, .sdw, .sep, .ses, .sfc, .sfera, .sfw, .sgm, .sid, .sidd, .sidn, .sie, .sig, .sis, .sk1, .sk2, .skcard, .skm, .sla, .slagz, .sld, .sldasm, .slddrt, .sldm, .sldprt, .sldx, .slm, .sls, .smf, .smil, .sms, .snagitstamps, .snagstyles, .snx, .sob, .spa, .spe, .sph, .spj, .spp, .spq, .spr, .sqb, .sql, .sqlite, .sqlite3, .sqlitedb, .sr2, .srf, .srw, .ssa, .ssfn, .ssk, .st, .ste, .stm, .stn, .stp, .str, .strings, .stw, .sty, .sub, .sum, .sumo, .sva, .svf, .svg, .svgz, .swf, .sxd, .sxg, .sxw, .syncdb, .t12, .t13, .t2b, .tab, .tax, .tb0, .tbn, .tcx, .tdf, .tdt, .te, .teacher, .tex, .text, .tfc, .tg4, .tga, .thm, .thp, .thumb, .tif, .tiff, .tjp, .tlb, .tlc, .tm, .tm2, .tmd, .tmv, .tmx, .tn, .tne, .tor, .tpc, .tpi, .trelby, .trm, .tvj, .txt, .u3d, .u3i, .udb, .ufo, .ufr, .uga, .unauth, .unity, .unity3d, .unx, .uof, .uot, .upd, .upk, .url, .usertile-ms, .usr, .utf8, .utxt, .v12, .vault, .vbox, .vbr, .vcf, .vct, .vda, .vdb, .vdf, .vdi, .vec, .vff, .vfs0, .vml, .vnt, .vob, .vpd, .vpe, .vpk, .vpp_pc, .vrml, .vrp, .vsd, .vsdm, .vsdx, .vsm, .vst, .vstm, .vstx, .vtf, .vue, .vw, .w3x, .wb1, .wb2, .wbc, .wbd, .wbk, .wbm, .wbmp, .wbz, .wcf, .wdb, .wdp, .webdoc, .webm, .webp, .wgz, .wire, .wmdb, .wmf, .wmo, .wmv, .wmv, .wn, .wotreplay, .wp, .wp4, .wp5, .wp6, .wp7, .wpa, .wpb, .wpd, .wpe, .wpg, .wpl, .wps, .wpt, .wpw, .wri, .wsc, .wsd, .wsh, .wtx, .wvl, .x, .x3d, .x3f, .xar, .xbdoc, .xbplate, .xdb, .xdl, .xf, .xhtm, .xla, .xlam, .xld, .xlf, .xlgc, .xlk, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xmind, .xml, .xmmap, .xpm, .xps, .xqx, .xwp, .xxx, .xy3, .xyp, .xyw, .y, .yal, .ybk, .yml, .ysp, .z3d, .zabw, .zdb, .zdc, .zif, .zip, .ztmp, .zw.

The File Spider Ransomware’s Ransom Note

This ransomware Trojan also displays an extraordinarily long ransomware note, which gives the victim detailed instructions on the attack and how to recover from it. Below is the full text of this ransomware Trojan's ransom notification:

'YOUR PC HAS BEEN INFECTED WITH FILE SPIDER VIRUS
As you may have already noticed, all your important files are encrypted and you no longer have access to them. A unique key has been generated specifically for this PC and two very strong encryption algorithm was applied in that process. Original content of your files are wiped and overwritten with encrypted data so it cannot be recovered using any conventional data recovery tool.
The good news is that there is still a chance to recover your files, you just need to have the right key.
To obtain the key, visit our website from the menu above. You have to be fast, after 96 hours the key will be blocked and all your files will remain permanently encrypted since no one will be able to recover them without the key!
Remember, do not try anything stupid, the program has several security measures to delete all your files and cause the damage to your PC.
To avoid any misunderstanding, please read Help section.
---
THIS WILL DECRYPT YOUR FILES
To visit our website you need to install a special web browser named Tor Browser. Be aware, our website is reachable only via Tor Browser and if you try to visit it using any other browser eg. Google Chrome, it wont work! Tor Browser can be downloaded from its official website listed below. Use newly installed browser to visit our website address. On our website there is a online tool that can generate decryption key using your ID Code, use that tool and you will get the key needed to decrypt your files. Also, you will be asked to make a payment for your Decryption Key, you will need a Bitcoins for that. More about bitcoins read in Help section. After you get your key, select Decrypter from menu and follow the instructions provided on that page.
This all may seem complicated to you, actually it's really easy. A link to Video Tutorial with live demonstration can be found inside Help Section. Good Luck!
Our Website Address: [xxxx://spiderwjzbmsmu7y.onion/] Download Tor Browser
---
THIS WILL DECRYPT YOUR FILES
During encryption process a unique key has been generated, used to encrypt your files, and then destoyed. To decrypt your files you need that key. We call that key a Decryption Key. You can not use the key from other PC, it wont work, you need a key coresponding to your PC. Your Decryption Key, required for decryption process, can be generated only from something that we call a ID Code, you will find that code below.
This is your ID Code, copy it carefully.
rzJisxRs70t/ILa9B61QymFqJSCgYQX5PbAgjifyMvt+X9Fc2e
+DiccqQ7SHenxtrz36svalTLAOUR79Jdp4ngajRCFP3tkIGY8xOJzo2De2MUzVNEJRb8QRsHnp
+32wjtL4lCjvSK/VAWslKeLllRBKelbWNchOHvTj7wJy8PTBl69I6FoHJkCXAglogFtFLR
+aIZxZU6Ew9VDumVEE90CspuhnFnr9pKzuVl64qya8pR53GaBpYRLPZhPjlgkgPZID4dCv4diMo2SzJ
byy4GmKwEuFhRDyQj8K346KGLAEJ5UB2ousV2xQ4EPtSEsPqSYm+MtHGXCEA9sp0vzTaQ==
---
THIS WILL DECRYPT YOUR FILES
Enter your Decryption Key and click Start Decrypting, seat back and relax, in few minutes you will have full access to all your files!
Decryption Key:
[ ... ]
0 Files decrypted. [Start Decrypting]'

Protecting Your Data from the File Spider Ransomware

The best way to protect your data from this ransomware Trojan is to have file backups of your data. Having file backups stored in safe places guarantees that you can recover your data after the attack. This, combined with a dependable security program that is fully up-to-date can help computer users protect their data from ransomware Trojans such as this one.