Gru Ransomware

The Gru Ransomware is a threat capable of locking a large array of filetypes and rendering them unusable. In a typical ransomware fashion, the threat will then extort its victims for money under the pretense of offering them to buy the decryption software necessary for the restoration of the data. Whenever Gru Ransomware encrypts a file, it will append '.gru' to that file's original name. As for the ransom note with instructions for the victims, it will be placed inside a text file named 'read_it.txt.'

According to the instructions, victims will have to 'buy' the decryption tool from the hackers for exactly $1500. However, the payment has to be in Bitcoins transferred to the provided crypto-wallet address. The note doesn't mention of victims of the threat will be allowed to send an encrypted file to be unlocked for free as a demonstration of the hackers' ability to restore the data. The note also fails to provide the affected users with any communication channels that can be used to reach the cybercriminals for additional details.

The full text of the note is:

'HEY !!!
All of your files have been encrypted
Your computer was infected with a ransomware virus. Your files have been encrypted and you won't
be able to decrypt them without our help.What can I do to get my files back?You can buy our special
decryption software, this software will allow you to recover all of your data and remove the
ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only.
How do I pay, where do I get Bitcoin?
Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search
yourself to find out how to buy Bitcoin.
Many of our customers have reported these sites to be fast and reliable:
Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com

Payment informationAmount: 0.1473766 BTC
Bitcoin Address: bc1qw0ll8p9m8uezhqhyd7z459ajrk722yn8c5j4fg'