Scarab-Osk Ransomware
The Scarab-Osk Ransomware is an encryption ransomware Trojan that is a variant of the Scarab Ransomware, a Trojan family that first appeared in June 2017. PC security analysts have observed at least a dozen variants in this family released between April and May of 2018, possibly indicating the use of this malware as part of a RaaS (Ransomware as a Service). The Scarab-Osk Ransomware is one of these recent variants in this malware family, released on May 25, 2018.
Another Member of the Scarab Family Tormenting Computer Users
The Scarab-Osk Ransomware uses a strong encryption algorithm to make the victim's files inaccessible, targets the user-generated files that include media files and a wide variety of document formats. The file types that the Scarab-Osk Ransomware and similar threats will target in their attacks include:
.3dm, .3g2, .3gp, .7zip, .aaf, .accdb, .aep, .aepx, .aet, .ai, .aif, .as, .as3, .asf, .asp, .asx, .avi, .bmp, .c, .class, .cpp, .cs, .csv, .dat, .db, .dbf, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .efx, .eps, .fla, .flv, .gif, .h, .idml, .iff, .indb, .indd, .indl, .indt, .inx, .jar, .java, .jpeg, .jpg, .js, .m3u, .m3u8, .m4u, .max, .mdb, .mid, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .pdb, .pdf, .php, .plb, .pmd, .png, .pot, .potm, .potx, .ppam, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .ps, .psd, .py, .ra, .rar, .raw, .rb, .rtf, .sdf, .sdf, .ses, .sldm, .sldx, .sql, .svg, .swf, .tif, .txt, .vcf, .vob, .wav, .wma, .wmv, .wpd, .wps, .xla, .xlam, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xqx, .xqx, .zip.
The Scarab-Osk Ransomware will encrypt the file names, as well as the file contents (something that sets the Scarab-Osk Ransomware apart from other Scarab family ransomware), and will mark all the affected files with the file extension 'OSK.' Once the Scarab-Osk Ransomware compromises a file, it will become unrecoverable permanently. After the Scarab-Osk Ransomware has encrypted the contents of the victim's PC, the Scarab-Osk Ransomware delivers a ransom note as a text note, demanding a ransom payment in exchange for the decryption program needed to restore the affected files. The Scarab-Osk Ransomware ransom note is contained in a text file named 'HOW TO RECOVER ENCRYPTED FILES.txt' containing the following message:
'YOUR FILES ARE CRYPTED!
Your personal identifier
6A02000000000000***46D93F
Your documents, photos, databases, saving in games and other important data were encrypted.
Data recovery requires a decryptor.
To receive the decryptor, you should send an e-mail to translatos@protonmail.com
In the letter, indicate your personal identifier (see At the beginning of this document).
If I can not connect through the mail, I can not
* Register on the site http://bitmsg.me (online delivery service Bitmessage)
* Send an email to BM-2cUvL7bCPmMZc7QonNfrdLQesmpxX9Sr53 with your email and ID of the identifier
Next, you pay the cost of the decryptor. In the reply letter you will receive the address Bitcoin-purse, for which it is necessary to perform the transfer of money in the amount of 0,013 bitcoin ( 0,013 BTC ~ 100 $ ).
[follow instructions on how to create a Bitcoin wallet]'
It is a good idea to refrain from following the instructions in the Scarab-Osk Ransomware's ransom note or contacting the criminals responsible for the Scarab-Osk Ransomware attack. Instead, computer users are advised to take precautionary measures against the Scarab-Osk Ransomware and similar threats.
Preventing the Scarab-Osk Ransomware Attacks and Protecting Your Data
The best protection against threats like the Scarab-Osk Ransomware is to have file backups stored on an offline device or the cloud. This allows victims of the Scarab-Osk Ransomware attack to restore the files compromised by the Scarab-Osk Ransomware, and avoid having to contact the criminals and negotiate for the return of the affected files (which rarely, if ever, works). Apart from file backups, computer users are advised to have an updated security program to scan their computers and ensure that threats like the Scarab-Osk Ransomware are not installed when browsing the Web or opening email attachments.
