Lampar Ransomware

The Lampar Ransomware spreads through spam email campaigns that distribute infected attachments and corrupted links. Classic symptoms of a ransomware infection include the inability to access the files stored on a computer and the appearance of a ransom note in the form of a text file and a pop-up message. After completing the encryption, the Lampar Ransomware modifies each affected file's name, replacing it with a string of random characters and adding the ".lampar" extension to the file's name. The malware generates a ransom note named "DECRYPT.TXT" and places it in every affected folder.

The Lampar Ransomware ransom note contains a general explanation of what has happened to the victim's files, and what should be done to get the files unlocked. A unique personal identifier is assigned to each victim, and it also is added to the note. The attackers' contact address is given as LaoXinWon@Protonmail.com, and they offer to decrypt for free three files with a total size of less than 5MB. As a means of putting the victim under pressure, the Lampar Ransomware developers state that the decryption key needed for unlocking the files will be stored only for a short period and deleted permanently if the victim does not contact them on time. It is not advisable to communicate with ransomware operators, though, as experience shows that victims rarely get a decryption key even after paying the ransom.

Lampar is a ransomware threat that is part of the Scarab Ransomware family.