Promorad2 Ransomware

The Promorad2 Ransomware Trojan is a file cryptor program based on the STOP Ransomware. The cyber threat at hand is one of many variants to be recorded in March 2019. The Promorad2 Ransomware seems to be a rushed version since it is almost identical to the parent Trojan. Also, the emails on the ransom note have been used in the past by the Blower Ransomware, and they are part of Av signature databases. The Promorad2 file cryptor modifies more than twenty file types and uses unique encryption keys, which prevents attempts at making a free decryptor. The Promorad2 Ransomware bears its name from the file marker injected into filenames. The malware is known for adding the '.promorad2' extension and something like 'Moquehue Lake.png' is renamed to 'Moquehue Lake.png.promora2.' The Promorad2 Ransomware writes a file called '_readme.txt' to the desktop so that users know whom to contact for a decryptor. The ransom note is standard for the STOP Ransomware variants and can be found below:

'ATTENTION!
Don't worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-1LFQOfI0Se
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" folder if you don't get answer more than 6 hours.

Your personal ID:
[random characters]'

The Promorad2 Ransomware might be associated with the 'blower@india.com' and the 'blower@firemail.cc' email accounts, but we are not confident that they are still accessible. Usually, the email accounts related to ransomware campaigns are deleted immediately after they are reported. However, some email providers on the TOR Network may not be as cooperative as the most trusted email providers. We recommend removing the Promorad2 Ransomware with the help of a credible cybersecurity utility. You should be using a backup manager to restore your data and make sure you have a good spam filter enabled.