Flash Ransomware

Cybercriminals have created a new variant of the previously identified Dcrtr Ransomware threat. The new, threatening tool is tracked as the Flash Ransomware and it can impact the files stored on the infected devices. Victims will no longer be able to access any of their documents, PDFs, archives, databases, images and many other file types. Each impacted file will have the 'ashtray@outlookpro.net' email address followed by '.flash' appended to its original name. Another threatening variant from the Dcrtr Ransomware family is the Ash Ransomware.

When all targeted file types have been processed and locked, the Flash Ransomware will deliver two ransom notes with instructions for its victims. The main message will be shown as a pop-up window generated from a file named 'Decryptor.hta.' The secondary note will be dropped as a text file named 'ReadMe_Decryptor.txt.'

The message in the text file states that victims must contact the attackers by sending an email to the 'ashtray@outlookpro.net' address. A single file that is less than 500 KB in size can be attached to the message to be decrypted for free. The pop-up window contains additional communication channels, including two emails - 'servicemanager@yahooweb.co' and 'servicemanager2020@protonmail.com' and a Jabber account at 'servicemanager@jabb.im.'

The full text of the pop-up note is:

'To recover data, write here:
1) servicemanager@yahooweb.co
2) servicemanager2020@protonmail.com (if you are Russian, then you need to register on the site www.protonmail.com through the TOR browser hxxps://www.torproject.org/ru/download/ , since the proton is prohibited in your country)
3) Jabber client - servicemanager@jabb.im (registration can be done on the website - www.xmpp.jp. web client is located on the site - hxxps://web.xabber.com/)

Do not modify files - this will damage them.
Test decryption - 1 file < 500 Kb.'

The text file contains the following message:

'To recover data, write here:
ashtray@outlookpro.net

Do not modify files - this will damage them.
Test decryption - 1 file < 500 Kb.'