Ghas Ransomware

The Ghas Ransomware is a threat created to lock the data of its victims specifically. The attackers will then extort the affected users for money, in exchange for restoring their access to important personal and business-related files, such as documents, PDFs, databases, archives, photos, etc. Although the Ghas Ransomware is a variant from the STOP/Djvu Ransomware family, this fact does not make the threat any less threatening.

Once Ghas is executed on the device, it will scan the files stored on the system and encrypt nearly all of them. Each locked file will have its original name modified to now include '.ghas' as a new file extension. When all targeted file types have been processed and rendered inaccessible, the malware will deliver a note with instructions from the threat actors. The ransom note will be dropped on the system as a text file named '_readme.txt.'

Ransom Note's Details

The ransom-demanding message associated with the Ghas Ransomware is almost completely identical to the notes found in other STOP/Djvu infections. The hackers state that they will assist with the restoration of the locked data only after the victims have transferred them a ransom of $980. However, that sum can apparently be cut in half to $490. There is a single requirement - victims must establish contact within the first 72 hours.

Communication with the cybercriminals can be carried out via the two email addresses mentioned in the ransom note. The primary address is 'support@sysmail.ch.' On the other hand, 'supportsys@airmail.cc' is described as a reserve email. Victims also are told that they can test the ability of the hackers to restore the locked files successfully by sending one file to be decrypted for free.

The full text of the note is:

'ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-0SLhZxAjRX
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@sysmail.ch

Reserve e-mail address to contact us:
supportsys@airmail.cc

Your personal ID:'