JANELLE Ransomware

The JANELLE Ransomware is a malware threat that is designed specifically to lock certain file types with an uncrackable encryption algorithm. Usually, ransomware threats go after the most widely used files, such as documents, PDFs, archives, databases, images, photos, etc. The attackers then extort their victims for money, promising to send the required decryption key and tool only after receiving the demanded sum.

During its encryption process, JANELLE appends the original names of all affected files with a new file extension - '.aes.JANELLE.' When all targeted files have been locked, the threat proceeds to drop its ransom note with instructions for the victims. JANELLE takes no chances in making sure the victims know about the attack. It delivers its ransom message as a pop-up window, an 'index.html' file, and a 'Readme.txt.' The text displayed in the pop-up window and the HTML file is identical, while the text file contains a shorter version of the note. The threat also will change the desktop image of the compromised system with one of its own.

JANELLE Ransomware's Demands

All three of the ransom notes state that the cybercriminals want to receive $600 payable using the Bitcoin cryptocurrency. The sum must be transmitted to the provided crypto-wallet address. After making the payment, victims are instructed to send proof to the 'janelle2021@protonmail.com' email address. The hackers specify that the ransom will stay at $600 for only 24 hours. After that, the sum will be doubled, while after 7 days the files will remain locked forever.

The instructions presented in the pop-up window and the HTML file are:

'JANELLE

Oops! Your FIles have been encrypted
What Happened to My Computer?
Your important files are encrypted. Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service.

Can I Recover My Files?
Sure. We guarantee that you can recover all your files safely and easily. But if you want to decrypt all your files, you need to pay. You have 24 hours to submit the payment. After that the price will be doubled. Also, if you don't pay in 7 days, you will not be able to recover your files forever.
How Do I Pay?
Payment is accepted in Bitcoin only. For more information, click
Please check the current price of Bitcoin and buy some bitcoins. For more information, click .

And send the correct amount to the address specified in this window.

After your payment, click . Best time to check: 9:00am - 11:00am GMT from Monday to Friday.

Once the payment is checked, you can start decrypting your files immediately.

Contact
If you need our assistance, send a message by clicking .
We strongly recommend you to not remove this software, and disable your anti-virus for a while, until you pay and the payment gets processed. If your anti-virus gets updated and removes this software automatically, you will not be able to recover your files even if you pay!

Send $600 worth of bitcoin to this address

The text file contains the following message:

Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!

Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $600 worth of bitcoin to this bitcoin address: 114NHHMdrCuJ6P3mwHHeyWvwdWdDWzqdpo
Next, please contact me at jannelle2021@protonmail.com with proof of payment
(You may need to disable your antivirus for a while.)

Q. Finding it hard to buy bitcoins ?
A: You can also purchase bitcoins at a bitcoin ATM near you.

Q: How do I know this is legit?
A: You have two options.
You either loose all your files or you pay the ransom and have your files decrypted.

*If you need our assistance, send an email at janelle2021@protonmail.com on the decryptor window.'