Redeemer Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Ranking: | 10,896 |
| Threat Level: | 100 % (High) |
| Infected Computers: | 118 |
| First Seen: | July 1, 2021 |
| Last Seen: | July 13, 2023 |
| OS(es) Affected: | Windows |
A new ransomware threat has been found to be lurking in the wild. Named Redeemer by its ill-minded creators, the threat so far has not been classified as belonging to any of the already established ransomware families. Its behavior, however, sticks to that of a typical ransomware threat.
The Redeemer Ransomware aims to infect the targeted computer, initiate an encryption routine with a strong cryptographic algorithm, and then lock the data stored on the breached device. The affected files will be rendered inaccessible and unusable. Furthermore, each encrypted file will have '.redeem' appended to its original name as a new extension. After the encryption process is completed, the Redeemer Ransomware will create a text file in every folder containing locked data. These files named 'Read Me.TXT' carry the ransom note of the threat.
According to the instructions, the only way to restore the data is by purchasing the decryption tool and the key from the cybercriminals. Users will have to pay the ransom using the Monero (XMR) cryptocurrency. To receive the crypto-wallet address where the funds must be transferred, users are directed to contact the equilibriumfinancialsupremecy@gmail.com address, found inside the ransom note. Also in the note, users will notice a lengthy key string that must be included in the email message.
The full set of instructions displayed in the ransom note is:
'-- Redeemer -
All your files have been encrypted using an advanced encryption algorithm. They cannot be decrypted without a decryption tool and a key.
In order to decrypt your files you will need to pay 20 XMR (Monero). After paying you will get a tool and a key to decrypt your files.
You can find more information about Monero on getmonero.org and you can buy it from localmonero.co or any other website or use any cryptocurrency exchange that has Monero listed.
WARNING: Do not modify the files, don't change their names and locations, otherwise they won't be able to be decrypted.
AFTER you obtain the required amount of XMR, contact equilibriumfinancialsupremecy@gmail.com and send the following key:'
