Mcauwpjib Ransomware

The Mcauwpjib Ransomware is a new addition to the Snatch Ransomware family. The Mcauwpjib Ransomware operates in the same way as the rest of the ransomware threats – it employs strong cryptographical encryption to lock the user's files and demands money to restore them. What sets it apart is the unique extension '.mcauwpjib' appended to the original filenames of each encrypted file and the specific email addresses provided by the criminals. The ransom note is dropped as a file named 'HOW TO RESTORE YOUR FILES.TXT' in every folder containing encrypted files. 

The majority of the note is taken straight from the Snatch Ransomware, with the biggest difference being the two email addresses used by Mcauwpjib - klowershit1835@tutanota.com and RemotePChelper@protonmail.com. No specific sum is mentioned for the files' decryption, but affected users can have up to three files decrypted for free. The files shouldn't contain important data such as databases, excel sheets or backups.

The full text of the note left by Mcauwpjib Ransomware is:

'!!!Hello!!!

All your files are encrypted and only I can decrypt them.

My mail is 

klowershit1835@tutanota.com or RemotePChelper@protonmail.com 

Write me if you want to return your files - I can do it very quickly!

Attention!

Do not rename the encrypted files, because of this you can lose them forever!!!!!

To prove that we are not stacticmers and really can decrypt your files,

you can send three files for test decryption !!! (except databases, Excel and backups)

PLEASE DO NOT CREATE A NEW LETTER! RESPOND TO THE

LETTER TO THIS LETTER.

This will allow us to see all the history of the census in

one place and respond quickly to you.

!!! Do not turn off or restart the NAS equipment. This will result in data loss!!!'