Novasof Ransomware

The Novasof Ransomware is a recently uncovered file-encrypting Trojan. Once malware researchers spotted and dissected this threat, they determined that it is a variant of the STOP Ransomware.

Spreading and Encryption

Researchers have not been able to determine what propagation method is being used in the spreading of this data-locking Trojan. Some believe that the authors of the Novasof Ransomware are employing mass spam email campaigns, bogus software updates, and pirated fake copies of legitimate applications to propagate their malicious creation. When the Novasof Ransomware succeeds in infiltrating a system, it launches a brief scan. The scan determines the locations of the files, which the Novasof Ransomware will target for locking. Next comes the encryption process. The Novasof Ransomware employs an encryption algorithm to lock all the data targeted. Once a file gets encrypted by the Novasof Ransomware, its name is changed. This ransomware threat adds a ‘.novasof’ extension at the end of the filename of each file affected. For example, a file you had named ‘purple-duck.png’ will be renamed to ‘purple-duck.png.novasof’ and will be rendered unusable.

The Ransom Note

Next, the ransom note is dropped. The Novasof Ransomware’s ransom note is called ‘_readme.txt’ and states:

’ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-WbgTMF1Jmw
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don’t get answer more than 6 hours.

Your personal ID:’

As you can see, the authors of the Novasof Ransomware demand $980 from the victim. However, they claim that if you pay them within 72 hours, you will get a 50% discount meaning you will ‘only’ have to pay them $490. Additionally, they offer to decrypt one file free of charge so that the victim is certain that they have a decryption key. The creators of the Novasof Ransomware offer two email addresses where you can get in touch with them – ‘gorentos@bitmessage.ch’ and ‘varasto@firemail.cc.’ In case the user prefers to communicate on Telegram instead of email, they give out their Telegram details too - @datarestore.

We recommend you to ignore the demands of cyber crooks. Instead, make sure you download and install a reputable antivirus software suite and use it to wipe off the Novasof Ransomware from your system once and for all.