Ransomnix Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 100 % (High) |
| Infected Computers: | 1 |
| First Seen: | August 24, 2017 |
| Last Seen: | February 11, 2019 |
| OS(es) Affected: | Windows |
The Ransomnix Ransomware is an encryption ransomware Trojan that claims to be associated with Anonymous. However, there is no real confirmation that this link exists. In many cases, the con artists will brand their ransomware Trojans with these labels as a way to claim that they are larger or more important than they really are. The Ransomnix Ransomware is not being used in widespread attacks currently. The Ransomnix Ransomware's main targets are Web servers and online websites. Con artists seem to use corrupted WordPress plug-ins to distribute the Ransomnix Ransomware and allow this ransomware Trojan to be installed on the targeted server.
An Overview of the Ransomnix Ransomware Trojan
The Ransomnix Ransomware uses the AES 256 encryption algorithm to encrypt the files on the targeted server, encrypting databases, text files, images, and server configuration files. Once the Ransomnix Ransomware has encrypted the victim's files, these files become inaccessible, making the targeted website or server go down. The Ransomnix Ransomware also will alter the meta tags and other data, making the target machine inoperable. The websites that have been compromised by the Ransomnix Ransomware attack will display the following message:
'Ransomnix We are Anonymous, We are legion, We don't forgive, We don't forget, United as one, Divided by zero, Expect us.'
Since it is possible that the compromised websites could be used to spread the Ransomnix Ransomware further, PC security analysts advise computer users to refrain from visiting compromised Web pages. In its attack, the Ransomnix Ransomware will mark the files encrypted with its encryption algorithm by adding the file extension '.Crypt' to the end of each affected file's name.
The Ransomnix Ransomware's Ransom Demand
The Ransomnix Ransomware delivers its ransom demand after encrypting the victim's files. The Ransomnix Ransomware delivers its ransom message to the root directory of the affected server in the form of a custom HTML Web page, which is displayed whenever a visitor reaches the compromised website. The message associated with the Ransomnix Ransomware infection can vary, but the one that has been linked to various versions of the Ransomnix Ransomware reads:
'Ransomnix
Now Pay BTC OR Payment will increase by 3TC each day after
Dear manager, on [ACCOUNT NAME] your database server has been locked, your databases files are encrypted and you have unfortunately "lost" all your data, Encryption was produced using unique public key RSA-2048 generated for this server. To decrypt files you need to obtain the private key. All encrypted files ends with .Crypt
Your reference number: [4 DIGITS] To obtain the program for this server, which will decrypt all files, you need to pay 1 bitcoin on our bitcoin address [RANDOM CHARACTERS] (today 1 bitcoin was [4 DIGITS] $).
Please use english language in your letters. If you don't speak english then use hxxps://translate.google.com to translate your letter on english language.
We don't know who are you, All what we need is some money.
Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again.
You do not have enough time to think each day payment will increase by [4 DIGITS] BTC and after one week your privite key will be deleted and your files will be locked for ever.'
The Ransomnix Ransomware has two variants, each with a different ransom note. Because of this, the Ransomnix Ransomware new variants are likely to continue appearing in the future. PC security analysts strongly advise computer users to refrain from paying the Ransomnix Ransomware ransom. At the current exchange rate, 1 Bitcoin is equivalent to 4200 USD approximately. The spike in Bitcoin prices in 2017 is likely one of the factors that have led to a current overabundance of ransomware attacks. As with other encryption ransomware Trojans, having good file backups on an offline device is the best way to protect your data.
Submit Comment
Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.