Prnds Ransomware

The Prnds Ransomware is a new file-locking Trojan that goes after users online. The goal of the Prnds Ransomware is to compromise your computer, apply an encryption algorithm to your files, and ask you to pay for a ransom fee to unlock your data. The Prnds Ransomware is a copy of the Dharma Ransomware.

Propagation and Encryption

The Prnds Ransomware is a threat that targets a wide variety of filetypes. To guarantee maximum damage, the Prnds Ransomware will likely go after .doc, .docx, .pdf, .txt, .xls, .xlsx, .ppt, .pptx, .db, .zip, .rar, .mp3, .midi, .mid, .aac, .wav, .mp4, .webm, .mov, .jpg, .jpeg, .png, .gif, .svg and many others. This will likely result in most of the files present on your computer being encrypted and, therefore, unusable. The locked files will receive new encryption –'.id-<VICTIM ID>.[prndssdnrp@mail.fr].prnds.' This means that a file that you named 'golden-eye.mp3' will be renamed to 'golden-eye.mp3.id-<VICTIM ID>.[prndssdnrp@mail.fr].prnds.' Each and every affected user will have a unique victim ID that allows the attackers to differentiate between the victims easily. It is not clear how exactly the Prnds Ransomware is being distributed. The attackers are likely to use phishing emails, malvertising campaigns, bogus software updates, torrent trackers, fake social media pages, etc. 

The Ransom Note

The Prnds Ransomware will drop its ransom note on the user's desktop. The file that contains the attackers' ransom message is named 'FILES ENCRYPTED.txt.' The ransom message is rather short. In it, the creators of the data-locker ask to be contacted via email – ‘prndssdnrp@mail.fr.' The attackers warn users against renaming any of the encrypted files, as it may result in data loss.

It is advisable to avoid contacting dodgy individuals like the authors of the Prnds Ransomware. Paying them the ransom fee demanded does not guarantee that you will receive the decryption key you need to restore your files.