Salsa Ransomware

The Salsa Ransomware is a ransomware Trojan first reported in April 2017. The Salsa Ransomware seems to be a standalone ransomware threat rather than part of a larger family of ransomware. The most common way in which the Salsa Ransomware is being distributed is by attaching corrupted files to spam email messages. When the victim opens the file, a compromised script downloads and installs the Salsa Ransomware on the victim’s computer.

The Too Spiced Salsa for Your Files

The Salsa Ransomware's intended target seems to be mainly corporate networks and servers, although the Salsa Ransomware attacks also can be quite effective against individual computer users. The Salsa Ransomware functions like most ransomware Trojans, encrypting the victim’s files by using a strong encryption algorithm to make them inaccessible. The Salsa Ransomware creates an index file that contains the names of all the files encrypted in the Salsa Ransomware attack. The Salsa Ransomware is designed to work fast in the background, encrypting as much of the victim's data as possible. The files encrypted in the Salsa Ransomware attack are marked with the file extension '.salsa222,' making it an easy task to know which files have been compromised in the Salsa Ransomware attack. It is likely that new variants of the Salsa Ransomware will be released over time. After encrypting the victim’s files, the Salsa Ransomware delivers its ransom note, which informs the victim about the attack and asks for the payment of a ransom. The Salsa Ransomware drops its ransom note in the following directory:

C:/ProgramData/DONOTDELETESALSA/CUCK%20HERE%20TO%20UNLOCK%20YOUR%20FILES%20SALSA222/READ%20TO%20UNLOCK%20FILES.salsa.html

The Salsa Ransomware’s ransom note is available in 40 different languages and is displayed on the infected computer’s default Internet browser. The full text of the Salsa Ransomware ransom reads:

'[LINKS TO VERSIONS FOR 40 LANGUAGES]
YOUR PERSONAL FILES HAVE BEEN ENCRYPTED/DAMAGED (USB, NETWORK, STORAGE, ...)
READ CAREFULLY IF YOU WANT YOUR FILES BACK!
IF YOU DO NOT PAY IN TIME THE PRICE WILL DOUBLE OR WURST YOUR FILES WEILL BE DELETED FOREVER!
Date (FILESS WILL BE DELETED FOREVER): [TIMESTAMP]
Date (PRICE WILL DOUBLE) : [TIMESTAMP]
Disable your Anti Virus now! If this program is deleted by your Anti Virus, you lose your files forever because it is impossible to decrypt your files!
PRICE: $500 in Bitcoins
We only accept bitcoins! Follow the steps below to decrypt your files:
Send exactly 0.465112 [BTC,BITCOINS] to this address: 1AY2tmQff1PYNM78B5VJaB4U6g7sGBY42y
After you send the payment, wait a few minutes...your files will be automatically decrypted and repaired. Your computer/files will be back to normal.'

PC security researchers advise against paying the Salsa Ransomware ransom or following the instructions in this ransom note.

Protecting Your Computer from an Attack

Computer users can recover from the Salsa Ransomware attack by restoring their files from a backup copy. Unfortunately, once the files have been encrypted in the Salsa Ransomware attack, they become unrecoverable. Because of this, the key to dealing with the Salsa Ransomware and other ransomware Trojans is to take preventive measures. Computer users should keep back ups of their files. Having file backups allows computer users the possibility of recovering from the Salsa Ransomware attacks without having to consider paying the ransom, which, in many cases, does not guarantee that the people responsible for the Salsa Ransomware attack will respond to the victim's request and provide the decryption key. Other important elements in preventing the Salsa Ransomware attacks include exercising caution when opening email attachments from unsolicited sources. This is especially important because corrupted email attachments are the main way in which the Salsa Ransomware and similar threats spread. Apart from having file backups and handling email with caution, having a reliable security program that is fully up-to-date is also an important element of protecting your computer from the Salsa Ransomware and other threats that use a similar attack.

SpyHunter Detects & Remove Salsa Ransomware